Study. uk . com
  1. Home
  2. All questions
  3. Question 161

CISM study material · question 161 of 1000

Senior leaders working with the risk executive function must settle three things about risk decisions. Which of these is one of them?

  1. Which staff receive role-based security training
  2. Which risk decisions may be delegated to subordinate organisations or other roles
  3. Which systems require penetration testing each year
  4. Which vendors may bid for security tooling
Show the answer

Answer: B. Which risk decisions may be delegated to subordinate organisations or other roles

SP 800-39 says senior leaders determine which risk decisions are reserved for specific senior roles, which are organisation-wide, and which can be delegated to subordinate organisations or other roles.

Source: NIST SP 800-39 (NIST) — Sec. 2.3.1 Governance

Challenge yourself on this topic → Study as cards