Study. uk . com
  1. Home
  2. All questions
  3. Question 174

CISM study material · question 174 of 1000

A team is about to begin a specific risk assessment and proposes selecting the methodology as their first activity. What does SP 800-30 say about when the methodology is settled?

  1. It is selected after results are gathered, to suit the data
  2. It is chosen during risk framing as part of the risk management strategy, before any particular assessment begins
  3. It is chosen by the assessment team at the start of each assessment
  4. It is dictated by the regulator for each sector
Show the answer

Answer: B. It is chosen during risk framing as part of the risk management strategy, before any particular assessment begins

SP 800-30 settles the methodology during risk framing, inside the risk management strategy, so it is already fixed before any particular assessment is commissioned.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3 Key Risk Concepts

Challenge yourself on this topic → Study as cards