Study. uk . com
  1. Home
  2. All questions
  3. Question 873

CISM study material · question 873 of 1000

A system's design and components change substantially during acquisition. What does NIST expect of the business impact analysis done earlier?

  1. It is superseded entirely by the system security plan that is written afterwards for that very same system here
  2. It is repeated only if the system's own impact level has changed at some point in the meantime since
  3. It may need to be repeated, because the analysis rested on a design that no longer holds
  4. It is carried forward unchanged, since the business processes it rested on have not changed at all
Show the answer

Answer: C. It may need to be repeated, because the analysis rested on a design that no longer holds

SP 800-34r1 notes the business impact analysis may need to be repeated during the development and acquisition phase because the system design and its components change after the initial analysis.

Source: NIST SP 800-34 Rev. 1 (NIST) — Sec. 3.2 Conduct the Business Impact Analysis

Challenge yourself on this topic → Study as cards