Study. uk . com
  1. Home
  2. All questions
  3. Question 222

CISM study material · question 222 of 1000

A vendor offers a single fixed risk model with fixed factors, scales and combining algorithm, claiming it suits any organisation. What does NIST say?

  1. Fixed models are mandatory for regulated organisations
  2. A single model is acceptable if certified by a standards body
  3. No single fixed risk model can meet the diverse needs of organisations, so each defines its own factors, scales and rules
  4. Fixed models are acceptable for qualitative assessment but not for quantitative work, where the scales have to carry real proportion
Show the answer

Answer: C. No single fixed risk model can meet the diverse needs of organisations, so each defines its own factors, scales and rules

NIST states a single risk model with a fixed set of factors, fixed scales and a fixed combining algorithm cannot meet the diverse needs of the organisations relying on SP 800-30, so each defines a model matching its view of risk.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.4 Effects of Organizational Culture

Challenge yourself on this topic → Study as cards