Study. uk . com
  1. Home
  2. All questions
  3. Question 360

CISM study material · question 360 of 1000

How does SP 800-30 link the relevance values an organisation assigns to threat events with its risk tolerance?

  1. Relevance values are set by the threat information provider
  2. The more risk-averse the organisation, the greater the range of values it considers
  3. Relevance values are independent of risk tolerance
  4. The more risk-averse the organisation, the fewer events it considers, since it filters harder before analysis
Show the answer

Answer: B. The more risk-averse the organisation, the greater the range of values it considers

SP 800-30 states the relevance values selected by organisations have a direct linkage to organisational risk tolerance, and that the more risk averse the organisation, the greater the range of values considered.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-2 Identify Threat Events

Challenge yourself on this topic → Study as cards