Study. uk . com
  1. Home
  2. All questions
  3. Question 604

CISM study material · question 604 of 1000

Why does SP 800-37 ask risk assessment to account for variability across an organisation?

  1. Different locations serving different business processes may face materially different risk
  2. Variability makes aggregation of the results impossible across the organisation as a whole estate at once
  3. Assessment cost varies considerably between the different locations that are being assessed each cycle
  4. Different locations are subject to different regulators and so also to a different set of reporting duties each year
Show the answer

Answer: A. Different locations serving different business processes may face materially different risk

SP 800-37 states the organisation may consider the variability of environments that may exist within it, such as different locations serving different missions and business processes, and the need to account for that variability in risk assessments.

Source: NIST SP 800-37 Rev. 2 (NIST) — Task P-3 Risk Assessment — Organization

Challenge yourself on this topic → Study as cards