Study. uk . com
  1. Home
  2. All questions
  3. Question 22

CISM study material · question 22 of 1000

A vulnerability discovered in one system turns out to stem from a design pattern reused across the estate. According to SP 800-39, what should follow?

  1. Immediate decommissioning of every system built on the pattern until a replacement design is approved
  2. Reassignment of the finding to the individual system owner, with no escalation beyond that authorisation boundary
  3. Feedback upward that may change the architecture or the organisation's risk tolerance
  4. Remediation confined to the affected system, so that disruption stays inside one authorisation boundary
Show the answer

Answer: C. Feedback upward that may change the architecture or the organisation's risk tolerance

SP 800-39 describes feedback flowing upward: a vulnerability found at Tier 3 may have systemic implications, triggering changes to the enterprise and security architecture or an adjustment to risk tolerance.

Source: NIST SP 800-39 (NIST) — Sec. 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards