An organisation is deciding how far to automate its monitoring. Which two considerations does SP 800-137 raise? Choose two.

Answer: C. The efficiency gained by standardising the process
B. The actual risk-management value of the automated information

SP 800-137 says organisations consider potential efficiencies of process standardisation gained with automation, the potential value or lack of value of the automated information from a risk management perspective, and intangibles such as personnel reassignment.

Source: NIST SP 800-137 (NIST) — Sec. 2.3 Role of Automation