Study. uk . com
  1. Home
  2. All questions
  3. Question 62

CISM study material · question 62 of 1000

A manager is challenged that periodic assessments are pure overhead because most come back clean. Which two additional purposes does NIST attribute to them? Choose two.

  1. They demonstrate management's commitment to the security programme
  2. They satisfy the requirement for an annual penetration test of every internet-facing system
  3. They remind users of their responsibilities
  4. They remove the need for continuous monitoring entirely
Show the answer

Answer: C. They remind users of their responsibilities
A. They demonstrate management's commitment to the security programme

SP 800-100 credits periodic assessment and reporting with three effects: exposing non-compliance, refreshing users' sense of what they are responsible for, and showing that management stands behind the programme.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.6 Ongoing Monitoring

Challenge yourself on this topic → Study as cards