Study. uk . com
  1. Home
  2. All questions
  3. Question 363

CISM study material · question 363 of 1000

A newly identified vulnerability has not yet been through risk assessment, so its severity is unknown. Which interim proxy does SP 800-30 permit?

  1. The vendor's published severity score
  2. The number of systems on which it appears
  3. The extent to which mitigation is unplanned
  4. The age of the affected component
Show the answer

Answer: C. The extent to which mitigation is unplanned

SP 800-30 permits how far mitigation remains unplanned to stand in for severity until the risks tied to the vulnerability have actually been assessed.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-3 Identify Vulnerabilities

Challenge yourself on this topic → Study as cards