Study. uk . com
  1. Home
  2. All questions
  3. Question 329

CISM study material · question 329 of 1000

Which two events does SP 800-30 name as triggers for a reassessment of risk? Choose two.

  1. Ongoing determinations of control effectiveness
  2. A change in the firm appointed as the organisation's external auditor
  3. Expiry of the engagement contract held by the previous assessor
  4. An incident that has occurred, such as a compromise of organisational information
Show the answer

Answer: A. Ongoing determinations of control effectiveness
D. An incident that has occurred, such as a compromise of organisational information

SP 800-30 lists reassessment triggers including ongoing determinations of control effectiveness, changes to systems or environments, results from compliance verification, and incidents such as cyber attacks compromising information or systems.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-1 Identify Purpose

Challenge yourself on this topic → Study as cards