Assessment and Evaluation Flashcards

A business impact analysis (BIA) primarily helps an organization determine what?

Answer: Which functions are critical and how long they can be disrupted before unacceptable impact

A BIA identifies critical processes, their dependencies, and maximum tolerable downtime.

When an organization decides to discontinue a high-risk activity entirely, which risk treatment is applied?

Answer: Risk avoidance

Eliminating the activity that creates the risk is risk avoidance.

Which is a key limitation of quantitative risk assessment?

Answer: Reliable numerical data for probability and impact is often unavailable

Quantitative methods depend on accurate data, which is often scarce for security events.

Which of the following best describes a 'design basis threat' (DBT)?

Answer: A profile of adversary attributes and capabilities that the protection system must be designed to defeat

The DBT defines the adversary characteristics used as the basis for designing and evaluating protection.

Why is it important to involve stakeholders from multiple departments in a security risk assessment?

Answer: They provide knowledge of assets, operations, and impacts that security staff may lack

Cross-functional input ensures assets and consequences are accurately identified and the results gain buy-in.

After implementing new countermeasures, what step in the risk management cycle should follow?

Answer: Monitor and review effectiveness on an ongoing basis

Risk management is cyclical, requiring continuous monitoring to confirm controls remain effective as conditions change.

Which source is generally considered the LEAST reliable for assessing the local crime threat to a facility?

Answer: Anecdotal rumors from a single unverified individual

Unverified anecdotal information lacks the reliability of documented, systematic data sources.