Study. uk . com
  1. Home
  2. All questions
  3. Question 332

CISM study material · question 332 of 1000

Why does SP 800-30 expect a policy-level risk assessment to remain valid longer than one supporting a compensating control on a system?

  1. Policy assessments are performed by more senior staff
  2. Policy assessments are quantitative and therefore more durable, because a number retains its meaning long after a qualitative rating has drifted well away
  3. System assessments use less reliable data
  4. The governance process for policy change is time-consuming, whereas a compensating control may become irrelevant at the next product release
Show the answer

Answer: D. The governance process for policy change is time-consuming, whereas a compensating control may become irrelevant at the next product release

SP 800-30 gives exactly this contrast: an assessment informing Tier 1 policy decisions must be relevant for an extended period because policy governance is time-consuming, while one informing a compensating control may be relevant only until the next product release.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-2 Identify Scope

Challenge yourself on this topic → Study as cards