Study. uk . com
  1. Home
  2. All questions
  3. Question 317

CISM study material · question 317 of 1000

An organisation lacks the in-house expertise to recover from a serious cyber attack and cannot justify hiring for it permanently. Which mechanism does IR 8286 describe for this situation?

  1. A compensating control substituting for the missing skill until the organisation is able to recruit for it
  2. A risk reserve of funds set aside during planning to employ a qualified third party if needed
  3. An avoidance decision to cease the activity that is at risk until the capability can be built up in-house
  4. A transfer of the risk to the incident response provider, whose own contract then carries the whole consequence instead
Show the answer

Answer: B. A risk reserve of funds set aside during planning to employ a qualified third party if needed

IR 8286 describes a risk reserve as funding or labour hours set aside and employed if a risk is triggered, giving the example of setting aside funds to employ a qualified third party to augment internal incident response and recovery.

Source: NIST IR 8286 (NIST) — Sec. 3.5 Plan and Execute Risk Response Strategies

Challenge yourself on this topic → Study as cards