Study. uk . com
  1. Home
  2. All questions
  3. Question 163

CISM study material · question 163 of 1000

A security programme definition names its mission, vision, goals and objectives, and sets out a high-level plan with short and mid-term targets. Which element does NIST say is still missing?

  1. A list of the systems in scope
  2. Performance measures to monitor accomplishment of the goals and progress toward the targets
  3. The names of the individuals accountable for each goal, so that progress against it can be chased to a person
  4. A statement of the organisation's risk appetite, against which each of the targets can be judged as it falls due
Show the answer

Answer: B. Performance measures to monitor accomplishment of the goals and progress toward the targets

NIST asks each organisation to define for its security programme a clear mission and objectives, a high-level plan with short and mid-term targets, and performance measures to continuously monitor accomplishment and progress toward those targets.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.1 Strategic Planning

Challenge yourself on this topic → Study as cards