Study. uk . com
  1. Home
  2. All questions
  3. Question 434

CISM study material · question 434 of 1000

A manager assumes metrics can only justify additional spending. Which further use does NIST identify?

  1. Identifying controls that are not productive, so resources can be withdrawn as well as added
  2. Determining the categorisation of each system
  3. Establishing the organisation's risk appetite
  4. Replacing the requirement for a security assessment, since the measures already report control effectiveness
Show the answer

Answer: A. Identifying controls that are not productive, so resources can be withdrawn as well as added

SP 800-100 points metrics in both directions: they show where more protection is worth funding, and they expose controls that are not earning their place.

Source: NIST SP 800-100 (NIST) — Ch. 7 Performance Measures

Challenge yourself on this topic → Study as cards