Study. uk . com
  1. Home
  2. All questions
  3. Question 685

CISM study material · question 685 of 1000

Why does NIST say an organisation should consider its motivations before choosing between quantitative and qualitative assessment?

  1. Motivation determines which regulator will review the results, since each supervisor accepts a different kind of evidence about the same controls
  2. An organisation motivated by certification compliance has different measurement needs from one motivated by cost reduction
  3. Only one motivation may be pursued at a time
  4. Motivation determines the assessment's approval authority, since a compliance exercise is signed off at a different level from a cost one
Show the answer

Answer: B. An organisation motivated by certification compliance has different measurement needs from one motivated by cost reduction

SP 800-55v1 states it is important to consider motivations for measuring before determining whether a quantitative or qualitative assessment is appropriate, giving compliance with an industry certification versus cost reduction as contrasting motivations.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.2 Types of Assessment

Challenge yourself on this topic → Study as cards