Study. uk . com
  1. Home
  2. All questions
  3. Question 941

CISM study material · question 941 of 1000

When does NIST say exercises and tests should be run?

  1. Periodically, after organisational or system changes, and when new guidance is issued — not only on a fixed calendar
  2. Annually, on the anniversary of the exact date on which the plan was first approved by the organisation that currently owns it
  3. Whenever the authorising official requests evidence
  4. Only after a real incident has exposed a weakness
Show the answer

Answer: A. Periodically, after organisational or system changes, and when new guidance is issued — not only on a fixed calendar

SP 800-34r1 states exercises and tests should be conducted periodically, following organisational changes, updates to the system, or the issuance of new guidance.

Source: NIST SP 800-34 Rev. 1 (NIST) — Sec. 3.5 Plan Testing, Training, and Exercises

Challenge yourself on this topic → Study as cards