Study. uk . com
  1. Home
  2. All questions
  3. Question 168

CISM study material · question 168 of 1000

An organisation declines to share any information with a partner because it cannot establish complete trust. How does SP 800-39 characterise this position?

  1. Unnecessarily restrictive, since parties can share information and take services from each other short of complete trust
  2. Unnecessarily permissive, since any sharing requires certification
  3. Correct, since information sharing requires complete trust
  4. Correct, unless a regulator compels the sharing
Show the answer

Answer: A. Unnecessarily restrictive, since parties can share information and take services from each other short of complete trust

SP 800-39 states trust among parties typically exists along a continuum, and organisations can still share information and obtain services even where their trust relationship falls short of complete trust.

Source: NIST SP 800-39 (NIST) — Sec. 2.6.1 Establishing Trust Among Organizations

Challenge yourself on this topic → Study as cards