Study. uk . com
  1. Home
  2. All questions
  3. Question 232

CISM study material · question 232 of 1000

How does SP 800-39 define risk tolerance, and where is it determined?

  1. The regulator's threshold for mandatory breach notification, which fixes the point at which the organisation is obliged to report a loss publicly
  2. The level of risk or degree of uncertainty acceptable to the organisation, determined as a framing activity at the organisation tier
  3. The residual risk remaining once the selected controls are in place, calculated at system level during the assessment of each individual system
  4. The maximum financial loss that the organisation could absorb within any single financial year, set by the finance function during its annual budget planning round
Show the answer

Answer: B. The level of risk or degree of uncertainty acceptable to the organisation, determined as a framing activity at the organisation tier

SP 800-39 defines risk tolerance as the level of risk or degree of uncertainty acceptable to organisations, and treats determining it as an important Tier 1 activity forming part of risk framing.

Source: NIST SP 800-39 (NIST) — Sec. 2.3.3 Risk Management Strategy

Challenge yourself on this topic → Study as cards