Study. uk . com
  1. Home
  2. All questions
  3. Question 512

CISM study material · question 512 of 1000

An organisation allows exceptions to its training requirement but does not say who may grant them. Which element does NIST's example policy include?

  1. A requirement that waivers be published internally
  2. An automatic expiry of all waivers at year end
  3. Naming who may grant the waiver, rather than leaving the decision open
  4. A maximum number of waivers per year
Show the answer

Answer: C. Naming who may grant the waiver, rather than leaving the decision open

SP 800-50r1's example policy disables accounts and privileges where refresher training is outstanding, but names who can grant a waiver — the security officer or a delegate — rather than leaving it open.

Source: NIST SP 800-50 Rev. 1 (NIST) — Sec. 2.2.1 Examples of Policy Statements

Challenge yourself on this topic → Study as cards