Study. uk . com
  1. Home
  2. All questions
  3. Question 338

CISM study material · question 338 of 1000

Two organisations differ on whether a threat event must have been observed before it is assessed. What does SP 800-30 say about this?

  1. Only observed threat events may be assessed, since anything else is speculation that cannot be given a likelihood
  2. Each organisation decides how much confirmation a threat event needs before it is considered relevant
  3. The decision is set by the applicable regulator, which publishes the list of events that every supervised organisation must assess
  4. All theoretically possible events must always be assessed, since omitting one leaves a gap an adversary can use
Show the answer

Answer: B. Each organisation decides how much confirmation a threat event needs before it is considered relevant

SP 800-30 says organisations consider what degree of confirmation is needed for threat events to be relevant: some consider only events observed internally or by peers, while others consider all possible threat events.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-3 Identify Assumptions and Constraints

Challenge yourself on this topic → Study as cards