Study. uk . com
  1. Home
  2. All questions
  3. Question 442

CISM study material · question 442 of 1000

Monitoring produces a finding that a control is ineffective. Which two categories of response does SP 800-137 permit? Choose two.

  1. Accepting, transferring, sharing, avoiding or rejecting the risk
  2. Removing the metric that produced the finding
  3. Deferring the finding to the next annual assessment
  4. Mitigating with technical, management or operational activity
Show the answer

Answer: D. Mitigating with technical, management or operational activity
A. Accepting, transferring, sharing, avoiding or rejecting the risk

SP 800-137 says organisations respond to findings with technical, management and operational mitigating activities, or with acceptance, transference or sharing, or avoidance or rejection.

Source: NIST SP 800-137 (NIST) — Ch. 3 The Process

Challenge yourself on this topic → Study as cards