Study. uk . com
  1. Home
  2. All questions
  3. Question 29

CISM study material · question 29 of 1000

A parent organisation must decide how much freedom its subsidiaries have to run their own risk processes. Under SP 800-39, which function specifies that degree of autonomy?

  1. The common control provider
  2. The risk executive function
  3. The enterprise architect
  4. The authorising official
Show the answer

Answer: B. The risk executive function

Among its responsibilities, the risk executive function specifies the degree of autonomy that subordinate organisations are permitted by parent organisations in framing, assessing, responding to and monitoring risk.

Source: NIST SP 800-39 (NIST) — Sec. 2.3.2 Risk Executive (Function)

Challenge yourself on this topic → Study as cards