Study. uk . com
  1. Home
  2. All questions
  3. Question 24

CISM study material · question 24 of 1000

A security manager is asked which outcomes a governance programme should deliver for risk management under SP 800-39. Which two are among the five named outcomes? Choose two.

  1. Performance-based outcomes through measuring and reporting risk metrics
  2. Strategic alignment of risk decisions with the mission
  3. Elimination of all residual risk this year
  4. Transfer of risk decision authority to the audit committee
Show the answer

Answer: B. Strategic alignment of risk decisions with the mission
A. Performance-based outcomes through measuring and reporting risk metrics

SP 800-39 lists five governance outcomes: strategic alignment, execution of the risk process, efficient resource allocation, performance-based outcomes through metrics, and delivered value. Eliminating residual risk is not achievable and is not an outcome.

Source: NIST SP 800-39 (NIST) — Sec. 2.3.1 Governance

Challenge yourself on this topic → Study as cards