Study. uk . com
  1. Home
  2. All questions
  3. Question 345

CISM study material · question 345 of 1000

A business process assessment has just been completed. What does SP 800-30 say can be done with that report at other tiers?

  1. It may be reused only within the same calendar year
  2. It applies only to the tier at which it was produced
  3. It can serve as an input to risk assessments at other tiers, so the work is reused rather than repeated
  4. It must be reformatted by the risk executive function before any of the other tiers is permitted to use it as an input
Show the answer

Answer: C. It can serve as an input to risk assessments at other tiers, so the work is reused rather than repeated

SP 800-30 lets a report produced at one tier feed assessments at the others, so a completed business process assessment becomes an input rather than work to be redone.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-4 Identify Information Sources

Challenge yourself on this topic → Study as cards