Study. uk . com
  1. Home
  2. All questions
  3. Question 431

CISM study material · question 431 of 1000

Having prioritised a list of corrective actions, how many does NIST suggest taking forward for full cost-benefit analysis?

  1. Only the single highest-priority action
  2. All candidates, so none is overlooked
  3. One per affected control family
  4. Up to three from the top of the prioritised list
Show the answer

Answer: D. Up to three from the top of the prioritised list

NIST states up to three corrective actions from the top of the prioritised list should be selected for conducting a full cost-benefit analysis, with the selections reflected in the corrective action plans.

Source: NIST SP 800-100 (NIST) — Sec. 7.4.3 Identify Corrective Actions

Challenge yourself on this topic → Study as cards