Study. uk . com
  1. Home
  2. All questions
  3. Question 31

CISM study material · question 31 of 1000

An organisation publishes a one-line risk tolerance statement on its intranet, yet staff continue to make inconsistent decisions. What does SP 800-39 say was missing?

  1. Guidance on how risk tolerance should shape ongoing decision-making, communicated alongside the statement
  2. Board approval of the statement
  3. A quantitative threshold expressed in currency
  4. Translation of the statement into every local language, so that staff in each region read the tolerance in their own words first
Show the answer

Answer: A. Guidance on how risk tolerance should shape ongoing decision-making, communicated alongside the statement

SP 800-39 asks that risk tolerance be established and communicated throughout the organisation together with guidance on how it affects ongoing decision-making, not merely published as a statement.

Source: NIST SP 800-39 (NIST) — Ch. 1 Introduction

Challenge yourself on this topic → Study as cards