Study. uk . com
  1. Home
  2. All questions
  3. Question 404

CISM study material · question 404 of 1000

An awareness session is written to be usable by any organisation in any sector. Which risk does NIST attach to that approach?

  1. It will fail to satisfy the annual training requirement, since generic content cannot be counted toward it at all
  2. It will be too technical for a general audience
  3. It will breach copyright in the source material
  4. It will be dismissed as an obligation rather than acted upon, because it feels impersonal and general
Show the answer

Answer: D. It will be dismissed as an obligation rather than acted upon, because it feels impersonal and general

SP 800-100 warns that a session generic enough to suit any audience gets logged as an obligation discharged. Material built for the particular participants is what actually changes behaviour.

Source: NIST SP 800-100 (NIST) — Sec. 4.3.2 Developing

Challenge yourself on this topic → Study as cards