Study. uk . com
  1. Home
  2. All questions
  3. Question 368

CISM study material · question 368 of 1000

Why does SP 800-30 require a rationale to accompany each likelihood assessment?

  1. So that the regulator can verify the calculation
  2. So that deterrence and the possibility of threat shifting are considered explicitly rather than assumed away
  3. So that the value can be converted to a monetary figure
  4. So that the assessor can be identified later
Show the answer

Answer: B. So that deterrence and the possibility of threat shifting are considered explicitly rather than assumed away

SP 800-30 pairs the scale with a written rationale so that deterrence and the chance of the threat shifting elsewhere are argued rather than quietly assumed.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 2-4 Determine Likelihood

Challenge yourself on this topic → Study as cards