Study. uk . com
  1. Home
  2. All questions
  3. Question 275

CISM study material · question 275 of 1000

An organisation completes its risk register once and files it. Which point does IR 8286 make about how a register derives its value?

  1. A register is valid for a full budget year once it has been completed, and is revisited only when the next year's planning round begins
  2. A register is a compliance artefact rather than a working document, and its value lies in being produced rather than in being used at all
  3. It captures a single point in time, so value depends on iterative use where agreed responses become the new current state
  4. A register need only be revised after a material incident
Show the answer

Answer: C. It captures a single point in time, so value depends on iterative use where agreed responses become the new current state

IR 8286 notes the register model illustrates a single point in time and that it is important the model be used consistently and iteratively, with the agreed response becoming the current state once mitigations are in place.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards