Study. uk . com
  1. Home
  2. All questions
  3. Question 395

CISM study material · question 395 of 1000

Awareness material is criticised for not explaining how to configure a control. How does NIST define the scope of awareness content?

  1. It explains only the threats facing the organisation, leaving the policy itself to be read separately
  2. It explains only the consequences of non-compliance, so that the staff understand what a breach would cost them
  3. It explains both what is required and how each of the requirements is to be achieved in practice
  4. It explains what security requires and what is not allowed, but deliberately not how
Show the answer

Answer: D. It explains what security requires and what is not allowed, but deliberately not how

SP 800-100 confines awareness to the what: which threats and weaknesses exist, and what is and is not permitted. Teaching the how is training's job.

Source: NIST SP 800-100 (NIST) — Sec. 4.2.1 Awareness

Challenge yourself on this topic → Study as cards