Study. uk . com
  1. Home
  2. All questions
  3. Question 510

CISM study material · question 510 of 1000

Which policy pattern does NIST describe for enforcing awareness training completion?

  1. Making training a condition of access, so an account is not granted or is suspended when training is incomplete
  2. Reporting non-completion to the external auditor
  3. Deducting a proportion of the employee's bonus
  4. Requiring the line manager to complete the training instead, so that the obligation is discharged by one person for each team
Show the answer

Answer: A. Making training a condition of access, so an account is not granted or is suspended when training is incomplete

SP 800-50r1 gives example policy statements requiring personnel to complete awareness training within a set period of being granted an account, with access not granted or suspended if the requirement is not met.

Source: NIST SP 800-50 Rev. 1 (NIST) — Sec. 2.2.1 Examples of Policy Statements

Challenge yourself on this topic → Study as cards