Study. uk . com
  1. Home
  2. All questions
  3. Question 223

CISM study material · question 223 of 1000

Which two authorisation decisions can risk assessment results support, according to SP 800-30? Choose two.

  1. Denying authorisation to operate a system
  2. Selecting the vendor for a security product
  3. Setting the organisation's risk appetite
  4. Authorising the common controls a system inherits
Show the answer

Answer: A. Denying authorisation to operate a system
D. Authorising the common controls a system inherits

SP 800-30 lists authorisation or denial of authorisation to operate systems, and authorisation to use the common controls inherited by those systems, among the decisions risk assessments support.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.2 Risk Assessments

Challenge yourself on this topic → Study as cards