Study. uk . com
  1. Home
  2. All questions
  3. Question 337

CISM study material · question 337 of 1000

An organisation must assess a threat about which very little credible information exists. What effect does SP 800-30 say the resulting uncertainty may have?

  1. It has no effect on tolerance, which is set independently
  2. It obliges the organisation to adopt a quantitative method
  3. It requires the threat to be excluded from the assessment
  4. It may reduce the organisation's risk tolerance, because uncertainty makes decision makers more cautious
Show the answer

Answer: D. It may reduce the organisation's risk tolerance, because uncertainty makes decision makers more cautious

SP 800-30 links assumption quality to tolerance: where an assumption rests on thin or unreliable information, that uncertainty tends to push decision makers toward accepting less risk.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-3 Identify Assumptions and Constraints

Challenge yourself on this topic → Study as cards