Study. uk . com
  1. Home
  2. All questions
  3. Question 82

CISSP study material · question 82 of 500

The board asks what the output of the risk framing step should actually be, since framing produces no control decisions of its own. What does an organisation produce by framing risk?

  1. A prioritised register of the risks the organisation currently faces, with owners assigned.
  2. A plan of action and milestones for every control weakness found in the last assessment.
  3. A system security plan describing the controls each information system implements.
  4. A risk management strategy stating assumptions, constraints, tolerance, and priorities and trade-offs.
Show the answer

Answer: D. A risk management strategy stating assumptions, constraints, tolerance, and priorities and trade-offs.

Framing establishes the context for later decisions and yields the risk management strategy. Registers, milestone plans and system security plans are outputs of assessment, response or system-level work.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards