Study. uk . com
  1. Home
  2. All questions
  3. Question 78

CISM study material · question 78 of 1000

Risk management tasks are assigned but consistently go undone, and investigation shows staff were named without being funded or freed from other duties. Which requirement was not met?

  1. Tasks must be assigned in writing by the authorising official, who countersigns each assignment before the work is scheduled into the annual plan
  2. Tasks must be delegated to the risk executive function, which carries all of them out centrally from one place rather than leaving them with system-level staff to complete
  3. Tasks must be scheduled within the system development life cycle, so that each one falls inside a phase that has its own entry and exit criteria
  4. Officials must identify and secure the resources for risk tasks, including funding and qualified personnel, and make them available
Show the answer

Answer: D. Officials must identify and secure the resources for risk tasks, including funding and qualified personnel, and make them available

SP 800-37 requires organisational officials to identify and secure the resources needed to complete risk management tasks and ensure those resources reach the appropriate personnel, covering both funding and qualified people.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards