Study. uk . com
  1. Home
  2. All questions
  3. Question 874

CISM study material · question 874 of 1000

An auditor finds the organisation's plan types do not match NIST's descriptions exactly. Which NIST statement bears on this?

  1. NIST leaves plan definitions to the authorising official alone
  2. NIST treats any deviation as a control failure
  3. NIST acknowledges there are no universally accepted definitions for contingency-related plans, so real scopes vary
  4. NIST requires the published plan names and the scopes that go with each of them to be adopted verbatim by every organisation
Show the answer

Answer: C. NIST acknowledges there are no universally accepted definitions for contingency-related plans, so real scopes vary

SP 800-34r1 states there are no universally accepted definitions for contingency-related planning, and the scope of individual plans across organisations may vary from the descriptions it gives.

Source: NIST SP 800-34 Rev. 1 (NIST) — Sec. 2.2 Types of Plans

Challenge yourself on this topic → Study as cards