Study. uk . com
  1. Home
  2. All questions
  3. Question 227

CISM study material · question 227 of 1000

Which four things does the assessment component of SP 800-39 identify?

  1. Threats, vulnerabilities inside and outside the organisation, the harm that would follow, and how likely that harm is
  2. Appetite, tolerance, capacity and residual risk
  3. Assets, owners, controls and costs
  4. Policies, standards, procedures and guidelines
Show the answer

Answer: A. Threats, vulnerabilities inside and outside the organisation, the harm that would follow, and how likely that harm is

SP 800-39's assessment component identifies threats to the organisation, vulnerabilities internal and external to it, the harm that may occur given the potential for threats exploiting vulnerabilities, and the likelihood that harm will occur.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards