Study. uk . com
  1. Home
  2. All questions
  3. Question 454

CISM study material · question 454 of 1000

Which two continuous monitoring responsibilities does SP 800-137 assign to the risk executive function? Choose two.

  1. Reviewing status reports as input to risk posture and tolerance decisions
  2. Providing an organisation-wide forum to consider all sources of risk
  3. Writing the security assessment plan for each of the controls that is being assessed in the cycle
  4. Approving each authorisation to operate
Show the answer

Answer: A. Reviewing status reports as input to risk posture and tolerance decisions
B. Providing an organisation-wide forum to consider all sources of risk

SP 800-137 states the risk executive function oversees the strategy and programme, reviews status reports as input to risk posture and tolerance decisions, promotes collaboration, and provides an organisation-wide forum to consider all sources of risk.

Source: NIST SP 800-137 (NIST) — Sec. 2.4 Roles and Responsibilities

Challenge yourself on this topic → Study as cards