Study. uk . com
  1. Home
  2. All questions
  3. Question 261

CISM study material · question 261 of 1000

Which two dates does IR 8286 say a risk detail record should carry? Choose two.

  1. The date the risk owner joined the organisation
  2. The date the affected system was commissioned
  3. The date the next assessment is expected
  4. The date the risk was first documented
Show the answer

Answer: D. The date the risk was first documented
C. The date the next assessment is expected

IR 8286's schedule fields cover when the risk was first written down, when it was last assessed, when mitigations are due to complete, and when the next assessment falls.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Detail Record

Challenge yourself on this topic → Study as cards