Study. uk . com
  1. Home
  2. All questions
  3. Question 693

CISM study material · question 693 of 1000

Which test does NIST give for deciding whether to keep a quantitative metric?

  1. Whether the metric is already in use by those organisations comparable to this one in size, sector and regulatory position
  2. Whether the underlying data can be collected automatically from the tooling that the organisation is already running today
  3. Whether the metric has already been reported continuously for at least a full year before the question about keeping it is ever asked at all
  4. Whether the data point illustrates the performance of a valid control or tracks a material risk to an objective
Show the answer

Answer: D. Whether the data point illustrates the performance of a valid control or tracks a material risk to an objective

SP 800-55v1 asks whether the data point shows how a valid control is performing or follows a material risk to an objective. Where it does neither, leaving it out is the better call.

Source: NIST SP 800-55 Vol. 1 (NIST) — Sec. 2.4 Metrics

Challenge yourself on this topic → Study as cards