Study. uk . com
  1. Home
  2. All questions
  3. Question 682

CISM study material · question 682 of 1000

Which example does NIST give of a quantitative assessment whose values keep their meaning outside the assessment?

  1. The programme has reached level four of five
  2. The risk is shown as amber on the heat map
  3. The organisation's security posture is rated moderate
  4. Ninety-eight percent of authorised accounts belong to current employees and two percent to former employees
Show the answer

Answer: D. Ninety-eight percent of authorised accounts belong to current employees and two percent to former employees

SP 800-55v1 gives exactly this example of a quantitative assessment, noting the values stay the same regardless of the context, which is what distinguishes them from semi-quantitative and qualitative results.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.2 Types of Assessment

Challenge yourself on this topic → Study as cards