Study. uk . com
  1. Home
  2. All questions
  3. Question 224

CISM study material · question 224 of 1000

A business process depends entirely on a system that cannot be adequately protected within budget. Which response does SP 800-30 identify as sometimes the most effective?

  1. Accepting the risk and increasing the insurance cover, so that any loss is met from the policy instead
  2. Transferring the system to a managed service provider whose contract carries the liability for a compromise
  3. Redesigning the business process so it has workable fallbacks when the system is compromised
  4. Decommissioning the business process entirely
Show the answer

Answer: C. Redesigning the business process so it has workable fallbacks when the system is compromised

SP 800-30 states that in certain situations the most effective way to reduce business risk attributable to information security risk is to redesign the business processes so there are viable workarounds when systems are compromised.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.2 Risk Assessments

Challenge yourself on this topic → Study as cards