Study. uk . com
  1. Home
  2. All questions
  3. Question 350

CISM study material · question 350 of 1000

An organisation looks in SP 800-30 for the formula to combine semi-quantitative values and cannot find one. What is the reason NIST gives?

  1. The formula applies only to quantitative assessments
  2. Semi-quantitative values are not intended to be combined
  3. Organisations vary in the relative weights they apply to risk factors, so no single algorithm is specified
  4. The formula is published separately by the regulator
Show the answer

Answer: C. Organisations vary in the relative weights they apply to risk factors, so no single algorithm is specified

SP 800-30 states that as organisations vary in the relative weights applied to risk factors, the guideline does not specify algorithms for combining semi-quantitative values; organisation-specific models supply them.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-5 Identify Risk Model and Analytic Approach

Challenge yourself on this topic → Study as cards