Study. uk . com
  1. Home
  2. All questions
  3. Question 84

CISM study material · question 84 of 1000

A due diligence report claims a supplier's trustworthiness cannot be evaluated because trust is subjective. How should the security manager respond under SP 800-39?

  1. Trustworthiness is equivalent to the absence of prior incidents, so a supplier with no reported breach is trustworthy by definition
  2. Trustworthiness is an attribute that can be measured, at least in relative terms if not quantitatively
  3. Trustworthiness is established solely by contract terms
  4. Trustworthiness applies only to technology products, which can be tested, and not to the organisations that build and operate them
Show the answer

Answer: B. Trustworthiness is an attribute that can be measured, at least in relative terms if not quantitatively

SP 800-39 defines trustworthiness as an attribute providing confidence in an entity's qualifications, capabilities and reliability, and states it can be measured at least in relative terms whether applied to people, processes or technologies.

Source: NIST SP 800-39 (NIST) — Sec. 2.6 Trust and Trustworthiness

Challenge yourself on this topic → Study as cards