Risk Management & Compliance Flashcards

Which risk management approach involves accepting the potential loss from a risk because the cost of mitigation exceeds the benefit?

Answer: Risk acceptance

Risk acceptance (also called risk tolerance or risk retention) is chosen when the cost of countermeasures outweighs the potential impact of the risk.

What is the formula for calculating Annualized Loss Expectancy (ALE)?

Answer: ALE = SLE × ARO

ALE equals Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO), representing the expected annual loss from a threat.

Which framework provides a structured, flexible approach to managing cybersecurity risk and is widely adopted in US critical infrastructure?

Answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) was specifically designed for US critical infrastructure and organizes practices around Identify, Protect, Detect, Respond, and Recover functions.

A qualitative risk assessment differs from a quantitative risk assessment primarily because it:

Answer: Uses descriptive ratings like High, Medium, and Low instead of exact numbers

Qualitative assessments use subjective ratings and descriptive scales (e.g., High/Medium/Low) rather than precise monetary calculations, making them faster but less precise.

Which term describes the remaining risk after security controls have been applied?

Answer: Residual risk

Residual risk is the risk that remains after safeguards or controls have been implemented to reduce the original (inherent) risk.

Under HIPAA, which type of information must be protected by covered entities and business associates?

Answer: Protected Health Information (PHI)

HIPAA mandates the protection of Protected Health Information (PHI), which includes any individually identifiable health data created, received, or transmitted by covered entities.

Which element is NOT typically part of a Business Impact Analysis (BIA)?

Answer: Annualized Rate of Occurrence (ARO)

ARO is a quantitative risk metric used in threat/risk analysis, not a BIA element; BIA focuses on recovery objectives (RTO, RPO) and maximum tolerable downtime.