Study. uk . com
  1. Home
  2. All questions
  3. Question 85

CISM study material · question 85 of 1000

A business unit wants to establish a data-sharing partnership and treats the trust decision as a commercial matter outside the risk process. How does SP 800-39 characterise such a decision?

  1. Trust decisions are outside the scope of security governance
  2. A decision to establish a trust relationship is an expression of acceptable risk
  3. A trust decision is a legal matter settled by contract review
  4. Trust decisions belong to procurement rather than to risk management, since the terms are settled before any data moves
Show the answer

Answer: B. A decision to establish a trust relationship is an expression of acceptable risk

SP 800-39 states plainly that decisions to establish trust relationships are expressions of acceptable risk, which places them inside the organisation's risk management framework rather than beside it.

Source: NIST SP 800-39 (NIST) — Sec. 2.6.1 Establishing Trust Among Organizations

Challenge yourself on this topic → Study as cards