Study. uk . com
  1. Home
  2. All questions
  3. Question 420

CISSP study material · question 420 of 500

A board asks the security team to guarantee that no further incidents will occur. Which framing does NIST SP 800-61 Rev. 3 offer instead?

  1. An organisation can eliminate incidents by reaching the highest maturity tier.
  2. An organisation can predict incident timing from historical frequency data.
  3. An organisation controls neither adversary tactics nor incident timing; the only certainty is that another incident will come.
  4. An organisation can transfer the residual risk of incidents entirely through insurance.
Show the answer

Answer: C. An organisation controls neither adversary tactics nor incident timing; the only certainty is that another incident will come.

SP 800-61r3 states organisations have no direct control over the tactics and techniques adversaries use, nor certainty about timing, other than knowing another incident is inevitable.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > Executive Summary

Challenge yourself on this topic → Study as cards