Information Risk Management Flashcards

What is Annual Loss Expectancy (ALE) used for in quantitative risk assessment?

Answer: To estimate the expected financial loss from a risk over a year

ALE (ALE = SLE × ARO) estimates the expected annual financial loss from a specific risk, used to justify security investments through cost-benefit analysis.

A risk assessment reveals that a control is more expensive than the risk it mitigates. A CISM should RECOMMEND:

Answer: Accepting the risk if it falls within the risk appetite

When a control's cost exceeds the risk value it addresses, accepting the risk is appropriate if it aligns with the organization's defined risk appetite.

Which of the following is MOST important when establishing risk assessment criteria?

Answer: Aligning criteria with the organization's business objectives and risk appetite

Risk assessment criteria must reflect the organization's specific business objectives and risk appetite to produce meaningful and actionable results.

A CISM discovers that business units are making risk decisions without consulting the security team. The BEST corrective action is to:

Answer: Implement mandatory security reviews into the project management process

Embedding mandatory security reviews into project management processes ensures risk is systematically considered before business decisions are finalized.

Which of the following BEST describes a threat in the context of information security risk?

Answer: A potential cause of an unwanted event that could harm an asset

A threat is any potential cause of an unwanted incident that could result in harm to an organization's assets or operations.

In risk management, which of the following BEST defines a 'vulnerability'?

Answer: A weakness that can be exploited by a threat to cause harm

A vulnerability is a weakness or gap in controls that a threat could exploit to compromise assets or operations.