Study. uk . com
  1. Home
  2. All questions
  3. Question 423

CISM study material · question 423 of 1000

A manager measures a process that does not yet exist. What does NIST say about the result?

  1. It will be indistinguishable from measuring a stable process, since both of them return a figure that the reader cannot interpret
  2. It will produce an artificially high score, because a process that is never exercised accumulates no failures for the metric to count
  3. It is prohibited and the metric must be withdrawn until the process has first been defined and then shown to be stable in daily operational use
  4. It will not provide meaningful performance information, though the poor result does flag an area needing improvement
Show the answer

Answer: D. It will not provide meaningful performance information, though the poor result does flag an area needing improvement

NIST states measuring non-existent or unstable processes will not provide meaningful information about security performance, while noting such a metric will certainly produce poor results and therefore identify an area needing improvement.

Source: NIST SP 800-100 (NIST) — Sec. 7.3 Metrics Development Process

Challenge yourself on this topic → Study as cards