Study. uk . com
  1. Home
  2. All questions
  3. Question 237

CISM study material · question 237 of 1000

A residual risk accepted two years ago is still recorded as acceptable, and nobody has revisited it. Why does SP 800-39 regard that as a problem?

  1. Acceptance decisions formally expire after twelve months
  2. Acceptability depends on the tolerance threshold and residual risk moves over time, so the judgement must be revisited
  3. Residual risk must be recalculated whenever a control is patched
  4. Only the risk executive may accept residual risk
Show the answer

Answer: B. Acceptability depends on the tolerance threshold and residual risk moves over time, so the judgement must be revisited

SP 800-39 makes acceptability a comparison against the tolerance threshold, and residual risk does not stand still. A judgement made two years ago says nothing about today's position.

Source: NIST SP 800-39 (NIST) — Ch. 1 footnote on residual risk

Challenge yourself on this topic → Study as cards