1-9

Question 1

Define Risk.

Answer 1

Uncertainty of outcome

Question 2

How do you assess risk?

Answer 2

By evaluating the culmination of likelihood of something happening and the impact if it does happen. (likelihood+impact)

Question 3

What is risk volatility?

Answer 3

Describes the extent to which the level of risk is likely to change over time.

Question 4

What is risk velocity?

Answer 4

Risk velocity is how fast an exposure can impact an organization

Question 5

What is cascading risk?

Answer 5

Cascading risk is the principle that risks are linked and failing to address one can cause a chain reaction. 3 categories: parallel risk, serial risk, and mixed (combo of parallel and serial).

Question 6

What is risk appetite?

Answer 6

Level of risk that an organization is comfortable engaging in. Determined by BoD. Categories include strategic, reputational, operational, financial, compliance, legal, and resilience.

Question 7

What is risk tolerance?

Answer 7

Acceptable variation in outcomes based on a specific performance measure. Acceptable deviation from risk appetite!

Question 8

What are the four processes in a risk assessment?

Answer 8

Identification, Analysis (likelihood, impact, and level), Evaluation (analysis comparison with appetite and tolerance), and Response.

Question 9

Name some risk assessment frameworks

Answer 9

NIST RMF (Risk Management Framework), NIST SP800-30 (Risk assessments), ISO 31000, OCTAVE (Operationally Critical Threat, Asset, and Vuln Assessment), and COBIT 2019.

Question 10

What is a risk analysis and its outcome?

Answer 10

Process by which likelihood, impact, and level of risk are determined. The outcome includes inherent and residual risks.

Question 11

AV (in risk analysis)?

Answer 11

Asset Value

Question 12

EF?

Answer 12

Exposure Factor

Question 13

SLE?

Answer 13

Single Loss Expectancy.

Question 14

ARO?

Answer 14

Annualized rate of occurrence

Question 15

ALE

Answer 15

Annualized loss expectancy

Question 16

How is SLE calculated?

Answer 16

AV * EF

Question 17

How ALE calculated?

Answer 17

SLE * ARO

Question 18

What is risk response?

Answer 18

Responsibility to determine how to respond to the outcome of a risk analysis

Question 19

What are the four risk treatment options?

Answer 19

Avoid/terminate, transfer, mitigate, or accept?

Question 20

What is risk transfer?

Answer 20

Usually accomplished by insurance. Used when likelihood is low but impact is high.

Question 21

What is risk mitigation?

Answer 21

Reduction or risk by implementing controls, countermeasures, or process changes.

Question 22

What is risk exception vs risk exemption

Answer 22

Exception is an acknowledgement of identified risk but approving it temporarily or permanently. Exemption is to not address the risk at all, deeming it too low of a chance or too high of expense/effort to mitigate.

Question 23

What are the control classifications?

Answer 23

Deterrent, Preventative, Detective, Corrective, Compensating