Study. uk . com
  1. Home
  2. All questions
  3. Question 391

CISM study material · question 391 of 1000

Which two uses does NIST identify for incident statistics in managing a security programme? Choose two.

  1. Determining the residual risk for each system
  2. Judging how well security policy and procedures are actually implemented
  3. Signalling when policies and procedures need to change
  4. Setting the organisation's risk appetite
Show the answer

Answer: B. Judging how well security policy and procedures are actually implemented
C. Signalling when policies and procedures need to change

NIST states incident statistics are valuable in determining the effectiveness of security policy and procedure implementation, and inform programme managers about the need to change policies and procedures.

Source: NIST SP 800-100 (NIST) — Table 2-1 Incident and Event Statistics

Challenge yourself on this topic → Study as cards