Study. uk . com
  1. Home
  2. All questions
  3. Question 34

CISM study material · question 34 of 1000

An organisation must satisfy both ISO/IEC management system requirements and NIST guidance, and its manager fears running two incompatible processes. What did NIST do to reduce that burden?

  1. Made ISO conformance sufficient to satisfy NIST guidance
  2. Aligned SP 800-39 with ISO/IEC 31000, 31010, 27001 and 27005 to reduce duplicated effort
  3. Restricted SP 800-39 to organisations that do not already follow ISO standards, so the two processes never run together
  4. Obtained formal recognition of its risk guidance as an ISO standard, so that one conformance audit covers both
Show the answer

Answer: B. Aligned SP 800-39 with ISO/IEC 31000, 31010, 27001 and 27005 to reduce duplicated effort

NIST states its mission includes harmonising standards, and that SP 800-39's concepts implement a management system and risk process similar to the ISO/IEC standards, reducing the burden on organisations conforming to both.

Source: NIST SP 800-39 (NIST) — Sec. 1.3 Related Publications

Challenge yourself on this topic → Study as cards