Study. uk . com
  1. Home
  2. All questions
  3. Question 75

CISM study material · question 75 of 1000

An organisation skips the RMF Prepare step at the organisational level and starts categorising systems immediately. Which consequences does NIST predict?

  1. The authorising official will be unable to grant any authorisation
  2. Systems will fail categorisation and have to be recategorised
  3. Security work becomes too costly, demands too many skilled professionals and produces ineffective solutions
  4. Common controls will be over-inherited by system owners
Show the answer

Answer: C. Security work becomes too costly, demands too many skilled professionals and produces ineffective solutions

SP 800-37 warns that skipping organisation-level preparation drives cost up, consumes scarce skilled staff and still yields solutions that do not work. Prepare exists to make the later steps affordable.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.1 Organization-Wide Risk Management

Challenge yourself on this topic → Study as cards