Which of the following NIST documents describes that minimizing negative impact on an organization and a need for sound basis in decision making are the fundamental reasons organizations implement a r

Question

Options

• ANIST SP 800-37
• BNIST SP 800-30
• CNIST SP 800-53
• DNIST SP 800-60

• A
  5% (1)
• B
  86% (18)
• D
  10% (2)

Explanation

NIST SP 800-30, "Guide for Conducting Risk Assessments," explicitly states in its purpose section that the two fundamental reasons organizations implement IT risk management are: (1) minimizing negative impact to the organization and (2) providing a sound basis for decision making. This document is the foundational guide specifically focused on why and how to conduct risk assessments, making it the natural home for that philosophical framing.

Why the distractors are wrong:

• A (SP 800-37) defines the Risk Management Framework (RMF) - it's the process of applying security controls through a lifecycle, not the foundational rationale for risk management.
• C (SP 800-53) is a catalog of security and privacy controls - it tells you what safeguards to implement, not why risk management exists.
• D (SP 800-60) is about categorizing information and systems by impact level - it feeds into the RMF but doesn't address risk management's fundamental purpose.

Memory tip: Think 800-30 = "30,000 foot view" - it's the high-level "why we do risk management" document. Or associate 30 with "rationale": you need a reason before you assess, and 800-30 gives you that reason.

No community discussion yet for this question.