Study. uk . com
  1. Home
  2. All questions
  3. Question 427

CISM study material · question 427 of 1000

Which two causes of poor control performance does NIST name that a purely technical investigation would miss? Choose two.

  1. Security patches removed and not replaced during operating system upgrades
  2. Lack of management awareness or commitment to security
  3. Incompatibility between patches
  4. Absence of the policies and procedures needed to ensure required security functions exist and are audited
Show the answer

Answer: B. Lack of management awareness or commitment to security
D. Absence of the policies and procedures needed to ensure required security functions exist and are audited

NIST's causation factors include resources, training, system upgrades, configuration practices, software compatibility, awareness and commitment, policies and procedures, architectures and inefficient processes. Awareness and policy are the two managerial causes here.

Source: NIST SP 800-100 (NIST) — Sec. 7.4.2 Collect Data and Analyze Results

Challenge yourself on this topic → Study as cards