Study. uk . com
  1. Home
  2. All questions
  3. Question 339

CISM study material · question 339 of 1000

Why does SP 800-30 require organisations to give guidance on identifying and compensating for uncertainty in individual risk factors?

  1. Because uncertainty in one or more factors propagates into the resulting evaluation of the level of risk
  2. Because regulators require an uncertainty statement in every report
  3. Because uncertain factors must be excluded from the calculation
  4. Because uncertainty invalidates qualitative assessment
Show the answer

Answer: A. Because uncertainty in one or more factors propagates into the resulting evaluation of the level of risk

SP 800-30 wants the reasons for uncertainty named as each factor is assessed, because doubt about a single factor carries forward into the risk level that comes out at the end.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-3 Identify Assumptions and Constraints

Challenge yourself on this topic → Study as cards