Study. uk . com
  1. Home
  2. All questions
  3. Question 145

CISSP study material · question 145 of 500

An organisation with a mature enterprise risk programme is told it must discard that programme to adopt NIST SP 800-39. Is that correct?

  1. No: SP 800-39 applies only at Tier 3 and leaves enterprise risk untouched.
  2. No: SP 800-39 is meant to fit inside a broader enterprise risk programme, adding an organisation-wide layer rather than replacing existing work.
  3. Yes, but only for systems categorised at high impact.
  4. Yes: SP 800-39 supersedes risk work performed under other directives.
Show the answer

Answer: B. No: SP 800-39 is meant to fit inside a broader enterprise risk programme, adding an organisation-wide layer rather than replacing existing work.

NIST positions SP 800-39 as part of a broader enterprise risk management programme and explicitly not a substitute for risk work performed under other legislation, directives or mission requirements.

Source: NIST SP 800-39 (NIST) — SP 800-39 > Abstract

Challenge yourself on this topic → Study as cards