Study. uk . com
  1. Home
  2. All questions
  3. Question 175

CISM study material · question 175 of 1000

An organisation relies on a three-year-old risk assessment because nothing formally changed. Why does SP 800-30 regard the validity of any assessment as bounded in time?

  1. Only assessments performed by an external party retain validity beyond the year in which they were made
  2. Missions, processes, systems, threats and operating environments all drift over time
  3. Assessments legally expire after twelve months
  4. Assessment results are superseded by the next audit report, which restates them against fresh evidence
Show the answer

Answer: B. Missions, processes, systems, threats and operating environments all drift over time

SP 800-30 bounds an assessment's usefulness in time because everything it rested on drifts — what the organisation does, how it does it, what it runs, who threatens it and where it operates.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.2 Risk Assessments

Challenge yourself on this topic → Study as cards