Study. uk . com
  1. Home
  2. All questions
  3. Question 110

CISSP study material · question 110 of 500

A large agency uses one lightweight method for early-stage projects and a more rigorous one for operational systems holding sensitive data. Is this consistent with NIST SP 800-30?

  1. No: a single methodology must be used so results remain reproducible.
  2. Yes, but only where the risk executive approves each departure in writing.
  3. No: methodology is fixed by the assessment approach, which cannot vary within an organisation.
  4. Yes: an organisation may use several methodologies, chosen by factors such as life cycle phase and criticality.
Show the answer

Answer: D. Yes: an organisation may use several methodologies, chosen by factors such as life cycle phase and criticality.

SP 800-30 allows a single methodology or several, chosen by considerations such as planning horizon, process maturity, life cycle phase, and the criticality or sensitivity of the information.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3 Risk Assessment

Challenge yourself on this topic → Study as cards