Study. uk . com
  1. Home
  2. All questions
  3. Question 91

CISSP study material · question 91 of 500

A firm has completed its risk responses and wants to define what its monitoring programme should establish. According to NIST SP 800-39, which three questions does risk monitoring answer? Choose three.

  1. Which residual risks should now be transferred to an insurer?
  2. What has changed in the systems or their environments?
  3. Are the responses still effective now that they are operating?
  4. Were the planned risk responses actually implemented?
Show the answer

Answer: C. Are the responses still effective now that they are operating?
B. What has changed in the systems or their environments?
D. Were the planned risk responses actually implemented?

Monitoring verifies implementation, determines ongoing effectiveness, and identifies changes. Choosing to transfer residual risk is a response decision, made in the respond component.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards