Study. uk . com
  1. Home
  2. All questions
  3. Question 41

CISM study material · question 41 of 1000

A manager benchmarks peers and finds none operate a purely centralised or purely decentralised security governance structure. What does NIST say about this observation?

  1. The peers are misreporting, since one of the two models must apply
  2. Hybrid structures are a transitional state that must resolve to full centralisation or full decentralisation within a single planning cycle
  3. The observation indicates immature governance at those organisations
  4. Completely centralised or decentralised implementations are rare; most organisations adopt hybrids on a continuum
Show the answer

Answer: D. Completely centralised or decentralised implementations are rare; most organisations adopt hybrids on a continuum

SP 800-100 states that completely centralised or decentralised implementations are quite rare, and that organisations usually adopt hybrid structures mixing characteristics of both to fit their mission and size.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.2 Governance Structures

Challenge yourself on this topic → Study as cards