Study. uk . com
  1. Home
  2. All questions
  3. Question 333

CISM study material · question 333 of 1000

An assessment reuses threat data gathered three years ago for a different exercise. Which consideration does SP 800-30 raise?

  1. Whether the data was gathered at the same tier
  2. The currency and age of all data used in assessing risk, which matters particularly when information is reused
  3. Whether the original assessor is still available to explain the judgements that were made at the time the data was gathered
  4. Whether the original assessment was quantitative, since only numeric results can be carried forward into a later exercise
Show the answer

Answer: B. The currency and age of all data used in assessing risk, which matters particularly when information is reused

SP 800-30 asks how fresh the underlying information is, not just what the results said. Reused data is the classic case, and its age bears directly on whether the conclusions still hold.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-2 Identify Scope

Challenge yourself on this topic → Study as cards