Study. uk . com
  1. Home
  2. All questions
  3. Question 242

CISM study material · question 242 of 1000

An organisation approves exceptions to policy in a change ticket and takes no further action. Which CSF 2.0 expectation is not being met?

  1. Exceptions must be approved by the board
  2. Exceptions must expire automatically after thirty days, so that no exception outlives the change it was granted for
  3. Changes and exceptions are assessed for risk impact, recorded and tracked, not merely approved
  4. Exceptions must be refused unless a compensating control is already in place and has been assessed as effective
Show the answer

Answer: C. Changes and exceptions are assessed for risk impact, recorded and tracked, not merely approved

CSF 2.0 subcategory ID.RA-07 treats changes and exceptions as risk events in their own right: each is managed, assessed for risk impact, recorded and tracked rather than simply approved.

Source: NIST CSWP 29 (NIST) — Appendix A ID.RA-07

Challenge yourself on this topic → Study as cards