Study. uk . com
  1. Home
  2. All questions
  3. Question 331

CISM study material · question 331 of 1000

An assessment team decides for itself how wide the assessment will be. Who does SP 800-30 say determines the scope?

  1. The external auditor who reviews the results, whose own remit fixes how wide the examination will have to be
  2. The organisational official requesting the assessment, together with the risk management strategy
  3. The assessment team itself, since it is the team that holds the technical knowledge of what can realistically be examined here
  4. The authorising official for each affected system, whose own authorisation decision the results will support
Show the answer

Answer: B. The organisational official requesting the assessment, together with the risk management strategy

SP 800-30 states risk assessment scope affects the range of information available for risk-based decisions and is determined by the organisational official requesting the assessment and the risk management strategy.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-2 Identify Scope

Challenge yourself on this topic → Study as cards