Study. uk . com
  1. Home
  2. All questions
  3. Question 268

CISM study material · question 268 of 1000

Controls have been deployed to treat a risk, and the register records the treatment as complete. Which follow-up does IR 8286 say is usually missing?

  1. Analysis after deployment to determine whether risk actually fell within the established tolerance
  2. Recording of the control identifiers in the register, so that each of the treatments can be traced back to the baseline it came from
  3. Verification that the controls were purchased within the budget that the treatment plan had approved for them
  4. Confirmation that the controls were installed by an accredited party working to the vendor's own instructions
Show the answer

Answer: A. Analysis after deployment to determine whether risk actually fell within the established tolerance

IR 8286 observes that once controls go in, hardly anyone goes back to check whether risk actually came down inside the tolerance that was set. Deployment gets recorded as if it were the outcome.

Source: NIST IR 8286 (NIST) — Sec. 2.2.2 Informal Analysis Methods

Challenge yourself on this topic → Study as cards