Study. uk . com
  1. Home
  2. All questions
  3. Question 361

CISM study material · question 361 of 1000

Two organisations receive the same unconfirmed threat report. The more risk-tolerant one sets it aside. How does SP 800-30 explain this?

  1. Higher tolerance goes with demanding firmer evidence before a threat event is taken seriously
  2. Risk tolerance does not affect the treatment of threat reports, which are judged only on the quality of their evidence
  3. More tolerant organisations lack the capability to assess the event and so set unconfirmed reports aside by default
  4. More tolerant organisations receive lower-quality threat information, because they pay less for their feeds
Show the answer

Answer: A. Higher tolerance goes with demanding firmer evidence before a threat event is taken seriously

SP 800-30 links the two directly: organisations willing to carry more risk tend to set a higher evidentiary bar before a threat event earns serious attention.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-2 Identify Threat Events

Challenge yourself on this topic → Study as cards