Study. uk . com
  1. Home
  2. All questions
  3. Question 274

CISM study material · question 274 of 1000

How does IR 8286 relate the risk assessment report to the cybersecurity risk register?

  1. They are complementary: the report records planning, execution and evaluation in detail and can serve as the risk detail record
  2. The report replaces the register once assessment is complete
  3. The register replaces the report for enterprise reporting
  4. The two are alternative names for the same artefact
Show the answer

Answer: A. They are complementary: the report records planning, execution and evaluation in detail and can serve as the risk detail record

IR 8286 states a risk assessment report and a cybersecurity risk register are complementary; the report provides a detailed record of planning, execution and evaluation, can inform the register, and could serve as the risk detail record.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards