Study. uk . com
  1. Home
  2. All questions
  3. Question 3

CISM study material · question 3 of 1000

During a governance review, the manager finds that executives have a shared but unwritten sense of how much risk is acceptable, and business units interpret it differently. Which CSF 2.0 Govern outcome is not being met?

  1. A standardised method for calculating and prioritising risk is communicated
  2. Strategic opportunities are characterised and included in risk discussions
  3. Adequate resources are allocated commensurate with the risk strategy
  4. Risk appetite and tolerance statements are established, communicated and maintained
Show the answer

Answer: D. Risk appetite and tolerance statements are established, communicated and maintained

CSF 2.0 asks that appetite and tolerance be written as statements that are established, shared and kept current. An unstated management preference is exactly what the outcome is meant to replace.

Source: NIST CSWP 29 (NIST) — Appendix A GV.RM-02

Challenge yourself on this topic → Study as cards