Study. uk . com
  1. Home
  2. All questions
  3. Question 372

CISM study material · question 372 of 1000

An organisation's policy states only low risks may be accepted. How does SP 800-39 describe the scope of acceptance?

  1. Acceptance is available only where no control exists
  2. Only low risks may ever be accepted
  3. Only risks that fall below the organisation's own published reporting threshold may be accepted without escalation
  4. Risk deemed low, moderate or high may be accepted depending on the particular situation or conditions
Show the answer

Answer: D. Risk deemed low, moderate or high may be accepted depending on the particular situation or conditions

SP 800-39 makes acceptance a question of tolerance rather than severity band: a risk rated low, moderate or high may all be accepted, depending on the situation and conditions.

Source: NIST SP 800-39 (NIST) — Task 3-1 Risk Acceptance

Challenge yourself on this topic → Study as cards