Study. uk . com
  1. Home
  2. All questions
  3. Question 476

CISM study material · question 476 of 1000

Which two difficulties does NIST identify in dealing with supply chain vulnerabilities? Choose two.

  1. It can be difficult to determine whether an event resulted from a supply chain vulnerability at all
  2. They may take years to be exploited or discovered
  3. They are always disclosed by the supplier as soon as they have been discovered internally by any of its own staff
  4. They can only be found by testing
Show the answer

Answer: B. They may take years to be exploited or discovered
A. It can be difficult to determine whether an event resulted from a supply chain vulnerability at all

SP 800-161r1 flags two problems: exploitation or discovery can be years away, and even then it is hard to say whether a supply chain weakness was what caused the event.

Source: NIST SP 800-161 Rev. 1 (NIST) — Sec. 2.2 Cybersecurity Risks Throughout Supply Chains

Challenge yourself on this topic → Study as cards