Study. uk . com
  1. Home
  2. All questions
  3. Question 299

CISM study material · question 299 of 1000

Which two external sources does IR 8286 suggest for improving the quality of qualitative analysis? Choose two.

  1. The organisation's insurance policy schedule
  2. Industry benchmarks or standards
  3. Metrics from similar previous risk scenarios
  4. The vendor's product documentation
Show the answer

Answer: B. Industry benchmarks or standards
C. Metrics from similar previous risk scenarios

IR 8286 suggests borrowing values and data from outside: published industry benchmarks or standards, measurements taken from comparable earlier scenarios, and what inspections and assessments turned up.

Source: NIST IR 8286 (NIST) — Sec. 3.3.1 Risk Analysis Types

Challenge yourself on this topic → Study as cards