Study. uk . com
  1. Home
  2. All questions
  3. Question 425

CISM study material · question 425 of 1000

An organisation assigns weights to its security metrics. On what does NIST say those weights should be based?

  1. The seniority of the person who asked for the metric to be produced
  2. The overall risk mitigation goals of the organisation
  3. The cost of collecting each metric
  4. The age of the process being measured
Show the answer

Answer: B. The overall risk mitigation goals of the organisation

SP 800-100 bases weighting on where the organisation wants risk brought down, expects department-level initiatives to weigh heavier, and treats weighted metrics as a way into capital planning.

Source: NIST SP 800-100 (NIST) — Sec. 7.3 Metrics Development Process

Challenge yourself on this topic → Study as cards