Study. uk . com
  1. Home
  2. All questions
  3. Question 565

CISM study material · question 565 of 1000

A manager argues a formal change process is not worth its overhead for a small organisation. Which economic argument does NIST make?

  1. The resources needed to correct a problem sound change control would have prevented usually far exceed the cost of the process
  2. Change control reduces the number of changes required
  3. Change control is mandated regardless of organisation size
  4. Change control eliminates the need for testing
Show the answer

Answer: A. The resources needed to correct a problem sound change control would have prevented usually far exceed the cost of the process

SP 800-100 makes the economic case directly: putting right a problem that sound configuration management would have stopped normally costs far more than building and running the process.

Source: NIST SP 800-100 (NIST) — Ch. 14 Configuration Management

Challenge yourself on this topic → Study as cards