Study. uk . com
  1. Home
  2. All questions
  3. Question 84

CISSP study material · question 84 of 500

An enterprise architect is mapping where different risk decisions are made. The organisation sets its overall appetite centrally, designs business processes in each division, and authorises individual systems in a shared service. Which three-tier structure does NIST SP 800-39 use for this?

  1. Governance, management, engineering.
  2. Enterprise, programme, project.
  3. Strategic, tactical, operational.
  4. Organisation, mission and business process, information system.
Show the answer

Answer: D. Organisation, mission and business process, information system.

The tiers in SP 800-39 are the organisation, its mission and business processes, and the individual information system. The other triples are generic management vocabulary, not the publication's.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards