Study. uk . com
  1. Home
  2. All questions
  3. Question 757

CISM study material · question 757 of 1000

A monitoring team tunes its detection rules until false positives fall to an acceptable level and considers the work done. Which half of NIST's recommendation is missing?

  1. Documenting the tuning decisions for audit
  2. Reducing false negatives to acceptable levels as well
  3. Applying the same tuning everywhere
  4. Obtaining approval for the tuning from the authorising official for the system
Show the answer

Answer: B. Reducing false negatives to acceptable levels as well

SP 800-61r3 asks for tuning against both error types — false positives and false negatives brought to acceptable levels — so work on one alone leaves the recommendation half done.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.CM.R2

Challenge yourself on this topic → Study as cards