Study. uk . com
  1. Home
  2. All questions
  3. Question 226

CISM study material · question 226 of 1000

A risk frame documents the organisation's assumptions and its tolerance. Which two further elements does SP 800-39 require? Choose two.

  1. The inventory of the systems that fall inside the scope of each assessment the organisation performs
  2. The priorities and trade-offs the organisation is willing to make
  3. The names of the assessors who will carry out each piece of the assessment
  4. Risk constraints on the assessment, response and monitoring alternatives
Show the answer

Answer: D. Risk constraints on the assessment, response and monitoring alternatives
B. The priorities and trade-offs the organisation is willing to make

SP 800-39 requires a credible risk frame to identify risk assumptions, risk constraints, risk tolerance, and priorities and trade-offs such as the relative importance of business functions and the time frames for addressing risk.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards