CISM: Certified Information Security ManagerDemo

Question

Management wants to understand the risk of engaging an Infrastructure-as-a-Service (IaaS) provider compared with internal hosting. Which of the following provides the BEST method for comparing risk scenarios?

A Reviewing mitigating and compensating controls for each risk scenario
B Mapping the risk scenarios by likelihood and impact on a chart
C Performing a risk assessment on the IaaS provider
D Mapping risk scenarios according to sensitivity of data

Explanation

A likelihood-impact chart (risk matrix) provides a consistent way to compare scenarios by plotting the two factors that determine risk: the probability of occurrence and the severity of the resulting effect. NIST SP 800-30 identifies risk as a function of likelihood and adverse impact.

Learn more

NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ502

Community Discussion