Study. uk . com
  1. Home
  2. All questions
  3. Question 95

CISM study material · question 95 of 1000

A technology the business insists on adopting carries vulnerabilities that no available control adequately addresses. Which response does SP 800-39 identify for this situation?

  1. Accepting the risk without recording it, since no control exists
  2. Deferring the decision until the vendor issues a fix
  3. Reengineering the current mission or business process to reduce the resulting risk
  4. Requiring the vendor to indemnify the organisation in full
Show the answer

Answer: C. Reengineering the current mission or business process to reduce the resulting risk

SP 800-39 accepts that some technologies carry vulnerabilities no control fully answers, leaving reengineering of the mission or business process as the way the residual exposure is brought down.

Source: NIST SP 800-39 (NIST) — Sec. 2.5 Tier Three — Information Systems View

Challenge yourself on this topic → Study as cards