Study. uk . com
  1. Home
  2. All questions
  3. Question 147

CISSP study material · question 147 of 500

A programme adopting the Risk Management Framework wants to know what Revision 2 added beyond the earlier system-level focus. Which change does it describe?

  1. It removed the categorisation step in favour of a single enterprise impact level.
  2. It links system-level risk work to organisation-wide risk work and fixes accountability for inherited controls.
  3. It restricted the framework to systems categorised at moderate impact or above.
  4. It replaced continuous monitoring with a fixed three-year reauthorisation cycle.
Show the answer

Answer: B. It links system-level risk work to organisation-wide risk work and fixes accountability for inherited controls.

Revision 2 connects risk management at the system level with risk management across the organisation, and makes accountability explicit for controls that systems inherit.

Source: NIST SP 800-37 Rev. 2 (NIST) — SP 800-37 Rev. 2 > Abstract

Challenge yourself on this topic → Study as cards