Study. uk . com
  1. Home
  2. All questions
  3. Question 33

CISM study material · question 33 of 1000

An enterprise risk officer worries that adopting SP 800-39 will duplicate the existing enterprise risk management programme. How should the security manager characterise the relationship?

  1. SP 800-39 applies only where no enterprise risk programme exists
  2. SP 800-39 is complementary to enterprise risk management and is used as part of it
  3. SP 800-39 supersedes enterprise risk management for all technology risk
  4. SP 800-39 and enterprise risk management must be kept strictly separate
Show the answer

Answer: B. SP 800-39 is complementary to enterprise risk management and is used as part of it

SP 800-39 positions its guidance as complementary to a more comprehensive enterprise risk management programme rather than replacing or subsuming other risk activities the organisation has implemented.

Source: NIST SP 800-39 (NIST) — Sec. 1.1 Purpose and Applicability

Challenge yourself on this topic → Study as cards