Study. uk . com
  1. Home
  2. All questions
  3. Question 430

CISM study material · question 430 of 1000

NIST orders candidate corrective actions before selecting among them. Which ordering does it prescribe?

  1. Ascending order of cost and descending order of impact
  2. Descending order of cost and ascending order of impact
  3. Chronological order of the weakness discovery date
  4. Alphabetical order by the affected control family
Show the answer

Answer: A. Ascending order of cost and descending order of impact

SP 800-100 ranks candidate actions cheapest first and highest-impact first, so that the action buying the most improvement for the least outlay surfaces at the top of the list.

Source: NIST SP 800-100 (NIST) — Sec. 7.4.3 Identify Corrective Actions

Challenge yourself on this topic → Study as cards