Study. uk . com
  1. Home
  2. All questions
  3. Question 351

CISM study material · question 351 of 1000

Is it acceptable under SP 800-30 for an organisation to use qualitative values for low-impact systems and a granular numeric scale for high-impact ones?

  1. No — a single scale must be used for all systems, so that results from anywhere in the estate can be compared
  2. Yes — different assessment scales may be identified for use in different circumstances
  3. No — the choice of scale is fixed by the system's security categorisation and cannot afterwards be varied
  4. Yes, but only with the authorising official's written approval for each system before the assessment begins
Show the answer

Answer: B. Yes — different assessment scales may be identified for use in different circumstances

SP 800-30 states organisations can identify different assessment scales for different circumstances, giving the example of qualitative values for low-impact systems and the most granular semi-quantitative values for moderate and high-impact ones.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-5 Identify Risk Model and Analytic Approach

Challenge yourself on this topic → Study as cards