Study. uk . com
  1. Home
  2. All questions
  3. Question 79

CISM study material · question 79 of 1000

A governance model pushes risk direction downward from the organisation to systems, but nothing flows back up. What does the NIST multi-level model require?

  1. Communication flows downward only, to preserve authority
  2. Each level manages risk independently with no inter-level flow, so that a decision taken at one level never constrains another
  3. Communication and reporting flow in both directions across the three levels
  4. Reporting flows upward only, during the annual assessment
Show the answer

Answer: C. Communication and reporting flow in both directions across the three levels

SP 800-37 describes communication and reporting as bidirectional information flows across the organisation, mission and business process, and system levels, so that risk is addressed throughout the organisation.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.1 Organization-Wide Risk Management

Challenge yourself on this topic → Study as cards