Study. uk . com
  1. Home
  2. All questions
  3. Question 437

CISM study material · question 437 of 1000

Which two items does NIST expect enterprise-level policy to cover for the awareness and training programme? Choose two.

  1. The vendor selected to deliver the training
  2. The syllabus of each individual course
  3. Development of the programme strategy and plan
  4. Maintenance of the programme over time
Show the answer

Answer: C. Development of the programme strategy and plan
D. Maintenance of the programme over time

NIST states requirements for the awareness and training programme should be documented in enterprise-level policy and include definition of security roles, development of the strategy and plan, implementation of the plan, and maintenance of the programme.

Source: NIST SP 800-100 (NIST) — Sec. 4.2 Components

Challenge yourself on this topic → Study as cards