Study. uk . com
  1. Home
  2. All questions
  3. Question 200

CISM study material · question 200 of 1000

An organisation declares that threat events whose impact falls below a stated value receive no further analysis. Is this consistent with SP 800-30?

  1. Yes — risk tolerance assumptions may state that events below a specific impact value do not warrant further analysis
  2. No — thresholds may be set for likelihood but not for impact
  3. Yes, but only if the regulator approves the threshold
  4. No — every identified threat event must be fully analysed
Show the answer

Answer: A. Yes — risk tolerance assumptions may state that events below a specific impact value do not warrant further analysis

SP 800-30 lets an organisation record, among its risk tolerance assumptions, a floor beneath which impact does not merit more analysis — the mechanism by which assessment effort is bounded.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Impact

Challenge yourself on this topic → Study as cards