Study. uk . com
  1. Home
  2. All questions
  3. Question 219

CISM study material · question 219 of 1000

A newly discovered vulnerability requires an organisation-wide mitigation mandate. How does this fit SP 800-30's observation about the pace of risk management at different tiers?

  1. Upper-tier decisions can never be made quickly
  2. Pace is identical at all three tiers
  3. Upper-tier risk management usually moves more slowly, but some upper-tier decisions require immediate action
  4. Upper-tier decisions always move faster than system-level ones, because the authority to mandate action already sits there
Show the answer

Answer: C. Upper-tier risk management usually moves more slowly, but some upper-tier decisions require immediate action

SP 800-30 notes risk management tends to move more slowly at Tiers 1 and 2 because responses address systemic issues, but that some Tier 1 decisions, such as an organisation-wide mitigation mandate for a new threat, involve immediate action.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.4 Application of Risk Assessments

Challenge yourself on this topic → Study as cards