Study. uk . com
  1. Home
  2. All questions
  3. Question 364

CISM study material · question 364 of 1000

Why does SP 800-30 ask organisations to assess how pervasive a predisposing condition is?

  1. To determine whether the condition should be recorded as a vulnerability in its own right
  2. To set the assessment's time frame
  3. To calculate the residual risk after treatment
  4. To help decide at which tier a risk response would be most effective
Show the answer

Answer: D. To help decide at which tier a risk response would be most effective

SP 800-30 uses pervasiveness to locate the response: how widely a predisposing condition runs indicates which tier is the right place to address it.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-3 Identify Vulnerabilities

Challenge yourself on this topic → Study as cards