Study. uk . com
  1. Home
  2. All questions
  3. Question 461

CISM study material · question 461 of 1000

Which two things is a monitoring strategy checked for when it is reviewed, under SP 800-137? Choose two.

  1. Whether it still accurately reflects organisational risk tolerances
  2. Whether it matches the monitoring strategies published by comparable organisations
  3. Whether it has been approved by the external auditor
  4. Whether its metrics are still applicable
Show the answer

Answer: A. Whether it still accurately reflects organisational risk tolerances
D. Whether its metrics are still applicable

SP 800-137 states that as changes occur the strategy is reviewed for relevance, accuracy in reflecting organisational risk tolerances, correctness of measurements, and applicability of metrics.

Source: NIST SP 800-137 (NIST) — Sec. 3.1 Define ISCM Strategy

Challenge yourself on this topic → Study as cards