Spot the false claim
Exercise and reference answers
- Questions
- False statement
- Tier 2 covers one system only
- Statements
- Tier 1 is the organisation
- Tier 3 is information systems
- Tier 2 covers one system only
- False statement
- Monitoring replaces risk management
- Statements
- Monitoring supports risk decisions
- Monitoring replaces risk management
- Monitoring is a tactic within it
- False statement
- Metrics never need revisiting
- Statements
- Metrics are framed per tier
- Metrics never need revisiting
- Metrics evolve with lessons learned
- Instructions
- Two claims are true and one is false. Tap the false one.
Explanation
_Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_