Study. uk . com
  1. Home
  2. All questions
  3. Question 77

CISM study material · question 77 of 1000

Two divisions of the same group manage risk very differently, one by top-down direction and the other by consensus among peers. What does SP 800-37 require despite this difference?

  1. That a consistent approach be applied to risk management processes from the organisation level to the system level
  2. That one division adopt the other's model within a fixed period
  3. That each division be authorised separately by a different official, so that the authorisation reflects the way each of them actually makes decisions
  4. That both revert to top-down command for risk decisions
Show the answer

Answer: A. That a consistent approach be applied to risk management processes from the organisation level to the system level

SP 800-37 accepts the approach may vary on a continuum from top-down command to decentralised consensus, but requires that in all cases organisations use a consistent approach applied organisation-wide from the organisation level to the system level.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards