Study. uk . com
  1. Home
  2. All questions
  3. Question 539

CISM study material · question 539 of 1000

Which two management tools does NIST name for making a security service provider accountable for results? Choose two.

  1. A performance bond lodged by the provider
  2. Metrics
  3. A service agreement specifying what is provided, to what extent and for how long
  4. An annual satisfaction survey of the end users
Show the answer

Answer: B. Metrics
C. A service agreement specifying what is provided, to what extent and for how long

SP 800-100 names metrics and a service agreement — setting out every service, how far it extends and how long it lasts — as the two levers holding a provider to the results promised.

Source: NIST SP 800-100 (NIST) — Sec. 12.2.1 Management Tools

Challenge yourself on this topic → Study as cards