Study. uk . com
  1. Home
  2. All questions
  3. Question 228

CISM study material · question 228 of 1000

SP 800-39 lists five risk responses. Why does it list sharing and transferring separately rather than treating them as one?

  1. Sharing applies to positive risk while transfer applies to negative risk, which is why both appear in the list
  2. Sharing splits a portion of the loss, while transfer moves the responsibility to another party
  3. Transfer requires an insurance contract while sharing does not, so the two are recorded under different agreements
  4. Sharing is permitted only in the public sector
Show the answer

Answer: B. Sharing splits a portion of the loss, while transfer moves the responsibility to another party

SP 800-39 names accepting, avoiding, mitigating, sharing and transferring. Transfer shifts the entire risk responsibility or liability to another organisation; sharing shifts only a portion, usually to a party better qualified to address it.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards