Study. uk . com
  1. Home
  2. All questions
  3. Question 348

CISM study material · question 348 of 1000

Why does SP 800-30 ask that an organisation-specific risk model include or be translatable into the standard risk factors?

  1. To facilitate reciprocity, so one organisation's assessment results can be accepted by another
  2. To ensure the model can be audited by the regulator, which checks that the factors used match the ones it publishes
  3. To allow scanning tools to import the model directly and apply its scales to the findings that they produce
  4. To satisfy the requirement for a quantitative model
Show the answer

Answer: A. To facilitate reciprocity, so one organisation's assessment results can be accepted by another

SP 800-30 ties this to reciprocity: a bespoke model that maps onto the defined risk factors produces results another organisation can accept rather than repeat.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-5 Identify Risk Model and Analytic Approach

Challenge yourself on this topic → Study as cards