Module 2

Question 1

An asset

Answer 1

Anything of value that is owned by an organization. It is something in need of protection.

Question 2

A vulnerability

Answer 2

Weakness in an information system, system security procedures, internal controls or implementation that could be exploited by a threat source.

Question 3

A threat

Answer 3

Any circumstance or event with the potential to adversely impact organizational operations
Something or someone that aims to exploit a vulnerability to thwart protection efforts.

Question 4

Risk assessment

Answer 4

Is defined as the process of identifying , estimating and prioritizing risks to an organization’s operations( including its mission, functions, image and reputation), assets, individuals, other organizations and even the nation.

Question 5

Risk treatment

Answer 5

Relates to making decisions about the best actions to take regarding the identified and prioritized risk.

Question 6

The four options to commonly used to respond to risk are :
1.Acceptance

Answer 6

Risk acceptance is taking no action to reduce the likelihood of a risk occurring.

Question 7

2. Transfer

Answer 7

Risk transference is the practice of passing the risk to another party, who will accept the financial impact of the harm resulting from a risk being realized in exchange for payment.

Question 8

3.Mitigation

Answer 8

Risk mitigation is the most common type of risk management and includes taking actions to prevent or reduce the possibility of a risk event or it’s impact.
Mitigation can involve remediation measures, or controls, such as security controls, establishing policies, procedures and standards to minimize adverse risk.

Question 9

4.Avoidance

Answer 9

Risk avoidance is the decision to attempt to eliminate the risk entirely. This could include ceasing operation for some or all of the activities of the organization that are exposed to particular risk.

Question 10

Qualitative Risk analysis

Answer 10

A method for risk analysis that is based on the assignment of a descriptor such as low, medium or high.

Question 11

Quantitative risk analysis

Answer 11

A method for risk analysis where numerical values are assigned to both impact and likelihood based on statistical probabilities and monetarized valuation of loss or gain.

Question 12

Risk Tolerance

Answer 12

The level of risk an entity is willing to assume in order to achieve a potential desired result.