Study. uk . com
  1. Home
  2. All questions
  3. Question 687

CISM study material · question 687 of 1000

An organisation early in its measurement journey relies on a risk matrix. What progression does NIST describe?

  1. As the ability to record and track data grows, moving toward the increased precision and reduced bias of quantitative assessment
  2. Moving directly to fully automated measurement, since the tooling itself removes the need for any of the intermediate stages altogether here
  3. Remaining with qualitative assessment permanently, since it communicates best to the executives who will have to act on the results it gives
  4. Abandoning assessment altogether in favour of continuous monitoring, which simply reports the current state without any judgement at all being applied to it here
Show the answer

Answer: A. As the ability to record and track data grows, moving toward the increased precision and reduced bias of quantitative assessment

SP 800-55v1 expects a shift over time: heavy early reliance on qualitative devices like the risk matrix, then a move to quantitative work as the capacity to record and track data grows.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.1 Measurement and Quantitative Assessment

Challenge yourself on this topic → Study as cards