Study. uk . com
  1. Home
  2. All questions
  3. Question 370

CISM study material · question 370 of 1000

An assessor proposes restating the organisation's risk tolerance and constraints in full within every individual risk assessment report. What does SP 800-30 say?

  1. They may be omitted only from quantitative assessments, where the numbers themselves are taken to carry the constraints implicitly
  2. Assumptions and constraints already recorded in the risk management strategy need not be repeated in each assessment
  3. Every assessment must restate all of them in full for completeness, so that the report can be read without reference to any of the other documents
  4. They must be restated only where the scope crosses tiers, since a single-tier assessment inherits them from the tier just above it
Show the answer

Answer: B. Assumptions and constraints already recorded in the risk management strategy need not be repeated in each assessment

SP 800-30 lets framing-stage assumptions and constraints stand once in the risk management strategy; individual assessments inherit them rather than reproducing them.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-3 Identify Assumptions and Constraints

Challenge yourself on this topic → Study as cards