Study. uk . com
  1. Home
  2. All questions
  3. Question 104

CISSP study material · question 104 of 500

A programme wants its risk assessments to show trends over several years and to survive a change of assessor. Which two properties does NIST SP 800-30 name for this, and what does each mean? Choose two.

  1. Repeatability: the assessment can be rerun later and compared with earlier runs.
  2. Comparability: results can be benchmarked against other organisations in the sector.
  3. Reproducibility: different assessors reach the same result from the same data.
  4. Traceability: each finding can be linked to the control requirement it came from.
Show the answer

Answer: C. Reproducibility: different assessors reach the same result from the same data.
A. Repeatability: the assessment can be rerun later and compared with earlier runs.

SP 800-30 defines reproducibility as different experts producing the same results from the same data, and repeatability as rerunning the assessment consistently so trends emerge.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3 footnote 19

Challenge yourself on this topic → Study as cards