Study. uk . com
  1. Home
  2. All questions
  3. Question 90

CISM study material · question 90 of 1000

Two years after an architectural decision, nobody can explain why a particular risk trade-off was made. Which SP 800-39 practice would have prevented this?

  1. Recording the decision in the system security plan only
  2. Documenting risk management decisions at all levels of the enterprise architecture
  3. Retaining the architect who made the decision
  4. Submitting every architectural decision to the audit committee, so that an independent body holds the record of what was chosen
Show the answer

Answer: B. Documenting risk management decisions at all levels of the enterprise architecture

SP 800-39 lists documenting risk management decisions at all levels of the enterprise architecture among the activities that integrate risk considerations into architecture, keeping the reasoning visible later.

Source: NIST SP 800-39 (NIST) — Sec. 2.4 Tier Two — Mission/Business Process View

Challenge yourself on this topic → Study as cards