Study. uk . com
  1. Home
  2. All questions
  3. Question 673

CISM study material · question 673 of 1000

Which tension does NIST identify in choosing how many security measures to collect?

  1. Fewer measures always produce clearer decisions, because a short list forces the attention onto the few things that really matter
  2. A single measure rarely supports a risk-based decision, yet resources limit how many can be collected and analysed
  3. The number of measures to be collected is fixed by the control baseline that the system in question has been assigned to operate
  4. More measures always produce better decisions, because every additional figure narrows the remaining uncertainty a little further still each time
Show the answer

Answer: B. A single measure rarely supports a risk-based decision, yet resources limit how many can be collected and analysed

SP 800-55v1 sets one measure as too thin a basis for a risk-based decision against the reality that no organisation can employ and analyse every candidate. Each has to find its own workable number.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.1 Measurement and Quantitative Assessment

Challenge yourself on this topic → Study as cards