Study. uk . com
  1. Home
  2. All questions
  3. Question 271

CISM study material · question 271 of 1000

Two comparable organisations receive the same system-level risk data, but one translates it into enterprise understanding far more readily. Which structural difference does IR 8286 identify?

  1. More frequent risk reporting
  2. An enterprise architecture linking each system to the business process it serves
  3. A larger enterprise risk function with more analysts to interpret what the systems are reporting
  4. A quantitative rather than qualitative risk model, whose figures travel upward without translation
Show the answer

Answer: B. An enterprise architecture linking each system to the business process it serves

IR 8286 says the gap between technical risk data and enterprise understanding narrows where architecture already ties systems to the processes they carry. Without that link the translation has to be improvised.

Source: NIST IR 8286 (NIST) — Sec. 2.2.3 Focus on the System Level

Challenge yourself on this topic → Study as cards