Study. uk . com
  1. Home
  2. All questions
  3. Question 194

CISM study material · question 194 of 1000

A likelihood rating of high is recorded with no period attached. Which requirement of SP 800-30 has been overlooked?

  1. Likelihood is assessed with respect to a specific time frame
  2. Likelihood must be approved by the risk executive
  3. Likelihood must be derived from a quantitative model before it is recorded
  4. Likelihood must be expressed as a percentage
Show the answer

Answer: A. Likelihood is assessed with respect to a specific time frame

SP 800-30 requires every likelihood judgement to name the window it applies to, whether the coming half-year, the coming year, or the run-up to some milestone. A bare rating means nothing.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Likelihood

Challenge yourself on this topic → Study as cards