Study. uk . com
  1. Home
  2. All questions
  3. Question 46

CISM study material · question 46 of 1000

An assessment repeatedly finds the same deficiencies year after year, with no record of what was done about earlier findings. Which senior security officer responsibility is not being discharged?

  1. Ensuring personnel receive security awareness training
  2. Periodically assessing the risk and magnitude of harm
  3. Developing risk-based, cost-effective security policy
  4. Maintaining a process for planning, implementing, evaluating and documenting remedial action
Show the answer

Answer: D. Maintaining a process for planning, implementing, evaluating and documenting remedial action

SP 800-100 gives the senior agency information security officer a standing process covering how remedial action is planned, carried out, judged and written down. Repeat findings with no audit trail mean that process is absent.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.3.3 Senior Agency Information Security Officer

Challenge yourself on this topic → Study as cards