Study. uk . com
  1. Home
  2. All questions
  3. Question 255

CISM study material · question 255 of 1000

A register entry reads simply 'ransomware'. Which form does IR 8286 recommend for a risk description?

  1. The identifier of the control that would mitigate it, taken from the baseline the organisation has chosen
  2. Cause and effect form — if this event occurs, then this consequence follows
  3. The name of the system most likely to be affected, with its criticality rating attached
  4. A single noun phrase naming the threat
Show the answer

Answer: B. Cause and effect form — if this event occurs, then this consequence follows

IR 8286 favours a cause-and-effect wording — if this happens, then that follows — because a bare noun cannot be analysed, prioritised or owned.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards