Certified Information Security Manager (CISM)Information Security Risk ManagementEasy
A financial services organization is assessing its information security posture. The Chief Information Security Officer (CISO) needs to prioritize remediation efforts based on the potential impact of identified vulnerabilities. Which of the following risk assessment approaches BEST facilitates this prioritization?
- AQuantitative risk assessment
- BQualitative risk assessment
- CHybrid risk assessment
- DBaseline risk assessment
Show answer & explanationAnswer & explanation
Correct answer: A. Quantitative risk assessment
Quantitative risk assessment assigns monetary values to assets and potential losses, allowing for a clear financial prioritization of remediation efforts. This approach directly addresses the need to prioritize based on potential impact.
Why the other options are wrong
- B. Qualitative risk assessment describes risks using descriptive terms, which is less effective for financial prioritization.
- C. Hybrid risk assessment combines both qualitative and quantitative elements but may not offer the direct financial prioritization needed without strong quantitative components.
- D. Baseline risk assessment compares an organization's security posture against industry standards, not primarily for financial impact prioritization.
Quantitative Risk Assessment
A risk assessment method that assigns numerical values (typically monetary) to assets, threats, vulnerabilities, and the likelihood and impact of risks, allowing for calculation of potential financial losses.
- Uses numerical values for risk factors.
- Calculates potential financial losses.
- Enables cost-benefit analysis for security controls.
Memory trick: Quantify losses to prioritize wisely.