Study. uk . com
  1. Home
  2. All questions
  3. Question 88

CISSP study material · question 88 of 500

Two peer organisations in the same sector adopt visibly different risk tolerances, and an auditor asks which one is set at the wrong level. What does NIST SP 800-39 say about this?

  1. The lower tolerance is always correct, since it reduces residual risk.
  2. There is no objectively correct level; tolerance reflects culture, loss type and executive outlook.
  3. Tolerance is fixed by the impact level of the organisation's highest-categorised system.
  4. Tolerance must be benchmarked against the sector median and adjusted to match it.
Show the answer

Answer: B. There is no objectively correct level; tolerance reflects culture, loss type and executive outlook.

SP 800-39 states there is no correct level of tolerance. It varies with organisational culture, may differ by type of loss, and is shaped by senior leaders' own outlook.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.3.3 Risk Management Strategy

Challenge yourself on this topic → Study as cards