Study. uk . com
  1. Home
  2. All questions
  3. Question 10

CompTIA Security+ study material · question 10 of 611

A manager decides, during a finding review, how much risk the organisation is willing to accept. What is wrong with deciding it at that point?

  1. Only the authorising official may accept risk
  2. Tolerance applies only to privacy risk
  3. Risk tolerance is set during framing, not case by case
  4. Tolerance must be expressed quantitatively
Show the answer

Answer: C. Risk tolerance is set during framing, not case by case

Deciding tolerance per finding lets the answer follow the finding. Framing fixes it in advance so assessments are measured consistently.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 § 2.3 Risk Framing

Challenge yourself on this topic → Study as cards