Study. uk . com
  1. Home
  2. All questions
  3. Question 269

CISM study material · question 269 of 1000

System-level risk data reaches the board as an unchanging red heatmap, and the board reports it cannot use it. How does IR 8286 explain this common failure?

  1. Data arrives either as a perpetually red heatmap or in volumes too large to be practical, so higher levels struggle to understand cyber risk
  2. Heatmaps are prohibited for enterprise reporting
  3. The board lacks the technical training to interpret the data
  4. The data is being reported too frequently
Show the answer

Answer: A. Data arrives either as a perpetually red heatmap or in volumes too large to be practical, so higher levels struggle to understand cyber risk

IR 8286 describes exactly this failure: system risk data reaching the top either as a heatmap that is always red or in quantities too great to use, leaving senior levels unable to grasp cyber risk.

Source: NIST IR 8286 (NIST) — Sec. 2.2.3 Focus on the System Level

Challenge yourself on this topic → Study as cards