Study. uk . com
  1. Home
  2. All questions
  3. Question 280

CISM study material · question 280 of 1000

After treatment, actual residual risk is measured higher than the target residual risk that was set. What does this indicate under IR 8286?

  1. The measurement method itself is invalid, since a properly calibrated method could not return a figure above the target that was originally set
  2. The risk should be transferred rather than mitigated, since mitigation has now been shown not to move the figure nearly far enough
  3. The response has not achieved what was intended, since actual residual risk should be equal to or less than target
  4. The target was set too low and should be raised to match what the controls that have been deployed can realistically achieve
Show the answer

Answer: C. The response has not achieved what was intended, since actual residual risk should be equal to or less than target

IR 8286 sets the expectation that risk left after management acts should sit at or below the target. Coming in above it means the response did not do what it was meant to do.

Source: NIST IR 8286 (NIST) — Sec. 3.2 Identify the Risks

Challenge yourself on this topic → Study as cards