Which two sources does an organisation-level risk assessment draw on, under SP 800-37? Choose two.

Answer: A. Aggregated system-level risk assessment results
B. Continuous monitoring information and strategic risk considerations

SP 800-37 states risk assessment at the organisational level leverages aggregated information from system-level results, continuous monitoring, and strategic risk considerations relevant to the organisation.

Source: NIST SP 800-37 Rev. 2 (NIST) — Task P-3 Risk Assessment — Organization