Study. uk . com
  1. Home
  2. All questions
  3. Question 550

CISM study material · question 550 of 1000

A provider's contingency planning policy is weaker than the organisation's own. Which question does NIST direct the organisation to ask?

  1. Whether the regulator must approve the difference
  2. Whether the provider will abide by the organisation's stricter policy
  3. Whether the difference invalidates the service agreement
  4. Whether the organisation should relax its policy to match
Show the answer

Answer: B. Whether the provider will abide by the organisation's stricter policy

SP 800-100 asks how the provider's security policies such as contingency planning differ from the organisation's: if the organisation's policy meets a higher standard, whether the provider will have trouble meeting it, and if lower, whether the provider will abide by the stricter policy.

Source: NIST SP 800-100 (NIST) — Table 12-4 General Considerations

Challenge yourself on this topic → Study as cards