Study. uk . com
  1. Home
  2. All questions
  3. Question 238

CISM study material · question 238 of 1000

An organisation maps only the risks its suppliers pose to it. Which point does SP 800-39 make about external risk relationships?

  1. Only suppliers create external risk relationships, since they are the only outside parties with access to the estate
  2. External relationships fall outside the risk management process and are handled entirely through contract management
  3. Customers are excluded because they hold no risk relationship at all, being the recipients of the service rather than parties to it
  4. Risk moves in both directions, so parties that could impose, transfer or receive risk are all identified
Show the answer

Answer: D. Risk moves in both directions, so parties that could impose, transfer or receive risk are all identified

SP 800-39 asks organisations to identify external entities with an actual or potential risk relationship — those that could impose, transfer or communicate risk to the organisation, and those to which the organisation could do the same.

Source: NIST SP 800-39 (NIST) — Sec. 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards