Study. uk . com
  1. Home
  2. All questions
  3. Question 681

CISM study material · question 681 of 1000

An organisation reports that it is at level three on a maturity model. How does NIST classify that number?

  1. As a measure, since it can be tracked over time and compared against the figures that were recorded in each of the earlier reporting periods for the same unit
  2. As quantitative, since it is expressed as a number and can therefore be averaged across all of the business units that report it upward
  3. As qualitative, since maturity is a subjective judgement made by the assessor rather than a measurement of anything that is actually countable
  4. As semi-quantitative: the three represents a set of qualities rather than a numerical value that holds outside the assessment
Show the answer

Answer: D. As semi-quantitative: the three represents a set of qualities rather than a numerical value that holds outside the assessment

SP 800-55v1 states semi-quantitative assessments use numbers that do not maintain their value outside the assessment context, giving the example that saying an organisation is at level three represents a set of qualities rather than a numerical value.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.2 Types of Assessment

Challenge yourself on this topic → Study as cards