Study. uk . com
  1. Home
  2. All questions
  3. Question 382

CISM study material · question 382 of 1000

Which two decisions taken at the organisation tier does SP 800-39 say constrain what the lower tiers can do? Choose two.

  1. The choice of vendor for endpoint protection
  2. The selection of common controls
  3. The configuration baseline for each of the server platforms
  4. The order of recovery for systems supporting critical business operations
Show the answer

Answer: B. The selection of common controls
D. The order of recovery for systems supporting critical business operations

SP 800-39 gives the selection of common controls, guidance from the risk executive function, and the establishment of the order of recovery for systems supporting critical missions as Tier 1 activities affecting Tiers 2 and 3.

Source: NIST SP 800-39 (NIST) — Sec. 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards