Study. uk . com
  1. Home
  2. All questions
  3. Question 421

CISM study material · question 421 of 1000

NIST describes evidence in a metrics programme evolving through four stages. Which sequence is correct?

  1. Risk framed, assessed, responded to, monitored
  2. Policy exists, policy is implemented, results of implementation, impact of those results on the mission
  3. Data collected, data analysed, data reported, data archived
  4. Controls selected, controls implemented, controls assessed, and finally controls authorised for live operational use
Show the answer

Answer: B. Policy exists, policy is implemented, results of implementation, impact of those results on the mission

NIST states implementation evidence changes from establishing existence of policy and procedures, to quantifying their implementation, to quantifying the results of that implementation, and ultimately to identifying the impact on the organisation's mission.

Source: NIST SP 800-100 (NIST) — Sec. 7.3 Metrics Development Process

Challenge yourself on this topic → Study as cards