Study. uk . com
  1. Home
  2. All questions
  3. Question 214

CISM study material · question 214 of 1000

A team has completed a thorough threat-oriented analysis. Why does SP 800-30 recommend running a second orientation as well?

  1. A second orientation halves the assessment's cost by reusing the evidence the first one gathered
  2. Threat-oriented analysis alone cannot produce likelihood values for the events it identifies
  3. The starting point can bias results and cause some risks not to be identified
  4. Regulators require two independent analyses
Show the answer

Answer: C. The starting point can bias results and cause some risks not to be identified

SP 800-30 warns that differences in the starting point can bias results, causing some risks not to be identified, so identifying risks from a second orientation improves the rigour and effectiveness of the analysis.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.3 Analysis Approaches

Challenge yourself on this topic → Study as cards