Information Risk Management Flashcards

In the context of CISM, what is the CORRECT formula for calculating risk?

Answer: Risk = Likelihood × Impact

Risk is calculated as the product of the likelihood that a threat event will occur and the impact it would have on the organization.

A CISM has identified a critical vulnerability but the cost of remediation exceeds the potential loss. The MOST appropriate risk response is:

Answer: Risk acceptance

When remediation costs exceed the potential impact, accepting the risk is the most cost-effective response, provided it falls within the organization's risk appetite.

Which of the following is MOST important when prioritizing risks for treatment?

Answer: The potential business impact and likelihood

Risks should be prioritized based on their potential business impact and likelihood of occurrence, not just technical severity or vendor ratings.

What is the purpose of a risk register in information security management?

Answer: To record identified risks, their assessments, and treatment decisions

A risk register is a formal document that records identified risks, their assessed likelihood and impact, treatment options chosen, and residual risk levels.

Which risk assessment approach assigns numerical values to probability and impact to calculate risk scores?

Answer: Quantitative risk assessment

Quantitative risk assessment uses numerical values (often monetary) to calculate risk scores, enabling objective comparison and cost-benefit analysis.

A CISM is conducting a risk assessment and discovers a high likelihood threat with low potential impact. This risk should be:

Answer: Evaluated in the context of the organization's risk appetite

All risks, regardless of their individual dimensions, must be evaluated against the organization's defined risk appetite before determining the appropriate response.