A municipality invents a unique risk-scoring scheme that external auditors familiar with NIST- and ISO-class approaches cannot map. What should the security program prefer?
Select an answer to reveal the explanation.
Short Explanation
Homegrown score math that nobody outside city hall can read is a translation tax. Lean on NIST/ISO-class patterns so auditors and partners speak the same dialect. Unique can still exist as local flavor—on top of a recognized backbone, not instead of one.
Full Explanation
Security risk programs should align to recognized framework examples—such as NIST- or ISO-class approaches—so methods, language, and scoring remain comparable, teachable, and auditable. A unique municipal scoring scheme that external auditors cannot map increases assessment friction, obscures residual risk, and weakens peer benchmarking. Keeping the scheme secret for competitive reasons, abandoning scoring for hallway consensus, or forcing auditors to memorize undocumented custom colors all reduce transparency and assurance quality. Alignment does not forbid local tailoring; it means mapping local criteria to widely understood likelihood, impact, and treatment concepts. Exam caveat: CISSP encourages use of established risk management frameworks and consistent terminology for governance and assurance. Operational check: select a reference framework, document how city scales map to it, train staff and vendors on shared language, and provide auditors a crosswalk. Retire opaque color-only schemes that lack defined criteria, and keep examples in policy so new assessors apply the same method. When customizing for civic safety or regulatory overlays, record the extensions explicitly rather than inventing an incompatible private dialect.