Study. uk . com
  1. Home
  2. All questions
  3. Question 267

CISM study material · question 267 of 1000

A team applies a standard control set to every new device as a matter of course. Which practice does IR 8286 criticise here?

  1. Applying controls without vendor certification
  2. Applying controls before the device is categorised
  3. Applying controls without first quantifying how they would affect risk
  4. Applying the same controls to devices of differing criticality
Show the answer

Answer: C. Applying controls without first quantifying how they would affect risk

IR 8286 criticises the common practice of automatically applying many security controls to protect a new device without first quantifying how those controls would affect risk.

Source: NIST IR 8286 (NIST) — Sec. 2.2.2 Informal Analysis Methods

Challenge yourself on this topic → Study as cards