Study. uk . com
  1. Home
  2. All questions
  3. Question 327

CISM study material · question 327 of 1000

Which two activities belong to the preparation step of a risk assessment under SP 800-30? Choose two.

  1. Selecting the controls that will be used to treat each of the risks the assessment has identified
  2. Identifying the assumptions and constraints under which the assessment is conducted
  3. Determining the likelihood of each of the threat events that the assessment has identified
  4. Identifying the sources of threat, vulnerability and impact information to be used
Show the answer

Answer: B. Identifying the assumptions and constraints under which the assessment is conducted
D. Identifying the sources of threat, vulnerability and impact information to be used

SP 800-30's preparation step identifies the purpose, the scope, the assumptions and constraints, the information sources, and the risk model and analytic approach. Likelihood determination belongs to the conduct step.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 3.1 Preparing for the Risk Assessment

Challenge yourself on this topic → Study as cards