Study. uk . com
  1. Home
  2. All questions
  3. Question 463

CISM study material · question 463 of 1000

An organisation's monitoring strategy is drafted at the business process tier. What does SP 800-137 require before it takes effect?

  1. It must be re-drafted at the organisation tier
  2. Officials at the organisation tier review and approve it, so risk tolerance across all missions is properly considered
  3. It applies only to the process that drafted it
  4. It must be approved by each system's authorising official
Show the answer

Answer: B. Officials at the organisation tier review and approve it, so risk tolerance across all missions is properly considered

SP 800-137 sends a strategy drafted at Tier 2 up to Tier 1 for review and approval, so that tolerance across every mission and business process has been weighed before it takes effect.

Source: NIST SP 800-137 (NIST) — Sec. 3.1.1 Organization and Mission Tier Strategy

Challenge yourself on this topic → Study as cards