Study. uk . com
  1. Home
  2. All questions
  3. Question 220

CISM study material · question 220 of 1000

Which two examples does SP 800-30 use to show that risks and responses run on different time scales? Choose two.

  1. Disclosure of current operational information can compromise operations immediately
  2. A change in investment strategy can take years to take effect
  3. A vulnerability scan completes within hours
  4. A configuration change requires board approval
Show the answer

Answer: A. Disclosure of current operational information can compromise operations immediately
B. A change in investment strategy can take years to take effect

SP 800-30 contrasts disclosure of current operational information compromising effectiveness immediately with changes in organisational policies or investment strategies that can take years to take effect.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.4 Application of Risk Assessments

Challenge yourself on this topic → Study as cards