Study. uk . com
  1. Home
  2. All questions
  3. Question 686

CISM study material · question 686 of 1000

Which measure does NIST say gives sharper insight into patching performance, and why?

  1. Mean time to remediate a vulnerability, because it deals with attainable non-zero numbers permitting a mathematically derived answer
  2. The number of critical findings outstanding, because severity matters most
  3. The percentage of systems scanned, because coverage precedes remediation
  4. The count of vulnerabilities patched in a year, because it is simple to collect from the existing tooling and easy for a reader to compare between years
Show the answer

Answer: A. Mean time to remediate a vulnerability, because it deals with attainable non-zero numbers permitting a mathematically derived answer

SP 800-55v1 prefers mean time to remediate over an annual patch count, because it works with attainable non-zero figures that a calculation can actually resolve.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.2 Types of Assessment

Challenge yourself on this topic → Study as cards