Study. uk . com
  1. Home
  2. All questions
  3. Question 87

CISSP study material · question 87 of 500

A mid-sized agency has no budget for a dedicated risk executive post, and its head asks whether SP 800-39 can therefore not be followed. What is the correct response?

  1. The function must be assigned to a single named senior official to be valid.
  2. The function may be outsourced entirely to the organisation's external auditor.
  3. The risk executive is a function, and may be filled by one official, an office, or a standing board.
  4. The function may be omitted where the organisation has fewer than a stated number of systems.
Show the answer

Answer: C. The risk executive is a function, and may be filled by one official, an office, or a standing board.

SP 800-39 makes the risk executive a function, not a post: one official, an office with staff, or a standing board may all fill it.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.3.2 Risk Executive (Function)

Challenge yourself on this topic → Study as cards