Study. uk . com
  1. Home
  2. All questions
  3. Question 534

CISM study material · question 534 of 1000

An organisation is about to choose a security service provider without knowing what its current environment costs or achieves. Which life cycle phase has been skipped?

  1. Assessment, which baselines the existing environment and gathers metrics and total cost of ownership
  2. Initiation, which determines the need
  3. Operations, which monitors the performance of the service once it is up and running inside the production estate
  4. Solution, which develops the business case and then settles the service arrangement with the provider that is chosen
Show the answer

Answer: A. Assessment, which baselines the existing environment and gathers metrics and total cost of ownership

SP 800-100 states the assessment phase develops an accurate portrait of the current environment before decision makers implement a service, baselining the environment, creating and analysing metrics, and establishing total cost of ownership.

Source: NIST SP 800-100 (NIST) — Table 12-1 Services Life Cycle

Challenge yourself on this topic → Study as cards