Study. uk . com
  1. Home
  2. All questions
  3. Question 558

CISM study material · question 558 of 1000

What does NIST say a cost-benefit analysis for security product selection should include, beyond the alternatives under consideration?

  1. A life cycle cost estimate for the status quo as well as for each identified alternative
  2. The cost of every product available in the market
  3. The vendor's internal cost of production
  4. The cost of the incident the product is intended to prevent, so that the purchase can be set directly against the loss avoided
Show the answer

Answer: A. A life cycle cost estimate for the status quo as well as for each identified alternative

SP 800-100 wants the do-nothing option priced too: a life cycle cost estimate for staying as things are, one for each alternative, and the benefits each alternative brings out.

Source: NIST SP 800-100 (NIST) — Ch. 12 Security Services and Products Acquisition

Challenge yourself on this topic → Study as cards