Study. uk . com
  1. Home
  2. All questions
  3. Question 328

CISM study material · question 328 of 1000

How does SP 800-30 distinguish the purpose of an initial assessment from that of a reassessment?

  1. An initial assessment establishes a baseline and identifies factors to track; a reassessment answers a specific question or updates the earlier picture
  2. An initial assessment is internal; a reassessment is external
  3. An initial assessment covers only a single tier while a reassessment covers all three of them, which is why a reassessment takes considerably longer to carry out
  4. An initial assessment is qualitative; a reassessment is quantitative
Show the answer

Answer: A. An initial assessment establishes a baseline and identifies factors to track; a reassessment answers a specific question or updates the earlier picture

SP 800-30 says an initial assessment establishes a baseline of risk and identifies threats, vulnerabilities and other factors to be tracked over time, while a reassessment provides comparative analysis of options or updates the picture.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-1 Identify Purpose

Challenge yourself on this topic → Study as cards