Study. uk . com
  1. Home
  2. All questions
  3. Question 307

CISM study material · question 307 of 1000

An estimate of likelihood and impact takes credit for every control listed in the control catalogue. What caution does IR 8286 give?

  1. The presence of an internal control does not mean it is necessarily effective; execution is key
  2. Only technical controls may be credited in an estimate
  3. Controls should be excluded from likelihood estimates entirely, so that the figure records the exposure before treatment
  4. Credit may be taken only for controls audited in the last year
Show the answer

Answer: A. The presence of an internal control does not mean it is necessarily effective; execution is key

IR 8286 treats listing controls as a proper step in analysis but insists on execution: a control that exists on paper has not been shown to work, so credit taken for it may be unearned.

Source: NIST IR 8286 (NIST) — Sec. 3.3.2 Techniques for Estimating Likelihood and Impact

Challenge yourself on this topic → Study as cards