Study. uk . com
  1. Home
  2. All questions
  3. Question 229

CISM study material · question 229 of 1000

Which two purposes does risk monitoring serve under SP 800-39, beyond confirming that planned responses were implemented? Choose two.

  1. Establishing the organisation's risk appetite
  2. Selecting the assessment methodology
  3. Identifying changes to systems and environments that alter risk
  4. Determining whether the responses remain effective after implementation
Show the answer

Answer: D. Determining whether the responses remain effective after implementation
C. Identifying changes to systems and environments that alter risk

SP 800-39 says monitoring verifies planned responses were implemented and requirements satisfied, determines their ongoing effectiveness, and identifies risk-impacting changes to systems and environments of operation.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards