Study. uk . com
  1. Home
  2. All questions
  3. Question 230

CISM study material · question 230 of 1000

A vulnerability register covers only information systems. Which two further locations does SP 800-39 say organisational vulnerabilities can occupy? Choose two.

  1. Governance structures and business processes
  2. Supply chain activities and external service providers
  3. The organisation's marketing materials and published product claims
  4. The regulator's published guidance notes and its notices
Show the answer

Answer: A. Governance structures and business processes
B. Supply chain activities and external service providers

SP 800-39 notes organisational vulnerabilities are not confined to systems but can include governance structures, business processes, enterprise and security architecture, facilities, equipment, life cycle processes, supply chain activities and external providers.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards