Study. uk . com
  1. Home
  2. All questions
  3. Question 20

CISM study material · question 20 of 1000

An organisation is starting to apply SP 800-39 and asks which risk management component belongs at Tier 1 and why it must come first. What is the correct answer?

  1. Risk framing, because the context it sets governs every risk activity at the tiers below
  2. Risk response, because it commits the budget
  3. Risk monitoring, because it detects change earliest
  4. Risk assessment, because it produces the threat and vulnerability data that framing, response and monitoring all consume
Show the answer

Answer: A. Risk framing, because the context it sets governs every risk activity at the tiers below

Tier 1 implements risk framing, which provides the context for all risk management activity in the organisation. Decisions made there constrain what Tiers 2 and 3 can do.

Source: NIST SP 800-39 (NIST) — Sec. 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards