Study. uk . com
  1. Home
  2. All questions
  3. Question 74

CISM study material · question 74 of 1000

A system owner proposes to decide their system's risk treatment purely on the system's own technical merits. Which two organisational factors does SP 800-37 say such decisions are also tied to? Choose two.

  1. The vendor's published product roadmap
  2. The tenure of the system's administrators
  3. The enterprise architecture and the need to reduce system complexity
  4. The organisation's mission and business objectives
Show the answer

Answer: D. The organisation's mission and business objectives
C. The enterprise architecture and the need to reduce system complexity

SP 800-37 states system-level risk decisions cannot be made in isolation, being closely linked to mission or business objectives, modernisation initiatives, the enterprise architecture and the need to manage complexity, and resource allocation.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.1 Organization-Wide Risk Management

Challenge yourself on this topic → Study as cards