Study. uk . com
  1. Home
  2. All questions
  3. Question 221

CISM study material · question 221 of 1000

Early in a system's life, little is known about threats or control effectiveness. What does SP 800-30 say about the risk model used at that point?

  1. No assessment should be attempted at all until the controls are deployed, since without them there is nothing at all whose effectiveness can be judged
  2. The model must be fixed for the system's whole life, so that results produced in different phases stay comparable with one another
  3. A coarse, high-level model may be appropriate, with a more detailed model used later once controls have been assessed
  4. The full detailed model must be used from the outset, since a coarse model would understate the risk that the system is carrying
Show the answer

Answer: C. A coarse, high-level model may be appropriate, with a more detailed model used later once controls have been assessed

SP 800-30 accepts a coarse model early, sufficient to choose controls, and a finer one afterwards to judge risk to particular missions or business functions once more is known.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.4 Effects of Organizational Culture

Challenge yourself on this topic → Study as cards