Assessment and Evaluation Flashcards

Which security metric is a leading indicator rather than a lagging indicator?

Answer: Percentage of employees completing security awareness training

Training completion predicts future performance, while incident counts measure outcomes that already occurred.

A gap analysis in security program evaluation compares what two things?

Answer: The current state of security with the desired or required state

Gap analysis identifies the difference between existing conditions and target standards or requirements.

What is residual risk?

Answer: The risk remaining after countermeasures have been applied

Residual risk is what remains once controls are in place and must be accepted or further treated.

A penetration test of a facility's physical security is best described as what type of evaluation?

Answer: Performance-based testing of the system's effectiveness

Penetration testing measures how well the security system actually performs against a simulated adversary.

In ASIS terminology, which document provides a structured approach for organizations to identify, analyze, and evaluate security risks?

Answer: ASIS Risk Assessment Standard

The ASIS Risk Assessment Standard establishes a framework for conducting security risk assessments.

Which method is most appropriate for estimating the probability of a rare event with no historical incident data at the site?

Answer: Using industry data, threat intelligence, and expert judgment

When local data is lacking, external data sources and expert opinion provide the best probability estimates.

What is the main advantage of using a risk matrix (heat map) in presenting assessment results to executives?

Answer: It visually prioritizes risks by likelihood and impact for quick decision-making

Heat maps communicate relative risk priority clearly so leadership can focus resources.