Study. uk . com
  1. Home
  2. All questions
  3. Question 252

CISM study material · question 252 of 1000

Which two items does IR 8286 say a risk register typically contains, beyond a description of the risk? Choose two.

  1. The probability of the risk occurring
  2. The audit history of the affected systems
  3. A ranking identifying the higher-priority risks
  4. The vendor contracts covering affected assets
Show the answer

Answer: A. The probability of the risk occurring
C. A ranking identifying the higher-priority risks

IR 8286's register description covers the risk itself, what it would cost if realised, how probable it is, how it is being mitigated, who owns it, and where it ranks against the others.

Source: NIST IR 8286 (NIST) — Sec. 2.1 Risk Register

Challenge yourself on this topic → Study as cards