Study. uk . com
  1. Home
  2. All questions
  3. Question 273

CISM study material · question 273 of 1000

IR 8286 divides risk context into two parts. Which pairing is correct?

  1. External context, the threat landscape the organisation faces; internal context, the vulnerability landscape inside its own estate and the controls it has deployed against them
  2. External context, the risk a supplier brings into the organisation; internal context, the risk an employee creates once inside it, together with the controls placed around both
  3. External context, the regulatory obligations the organisation must satisfy; internal context, the technical controls it has deployed and the evidence it holds that they operate
  4. External context, the expectations of customers, regulators and partners; internal context, the organisation's objectives, governance, culture, appetite and policies
Show the answer

Answer: D. External context, the expectations of customers, regulators and partners; internal context, the organisation's objectives, governance, culture, appetite and policies

IR 8286 describes external context as the expectations of outside stakeholders such as customers, regulators, legislators and partners, and internal context as factors including objectives, governance, culture, risk appetite, tolerances, policies and practices.

Source: NIST IR 8286 (NIST) — Sec. 3.1 Identify the Context

Challenge yourself on this topic → Study as cards