Following a Security Assessment, the Chief Information Security Officer (CISO)

question 333

Multiple Choice

Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating potential risk treatment strategies. As part of the CISO's evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize response actions, the CISO uses past experience to take into account the exposure factor as well as the external accessibility of the weakness identified. Which of the following is the CISO performing?

• A) Documentation of lessons learned
• B) Quantitative risk assessment
• C) Qualitative assessment of risk
• D) Business impact scoring
• E) Threat modeling

---

Definitions:

Minimal Effort

The least amount of physical or mental energy expended to achieve an objective.

Effective Time Management

The practice of organizing and planning how to allocate your time between specific activities wisely and efficiently.

Interdependent Roles

Positions or functions within a system that rely on each other to achieve objectives or outcomes.

External Behavior

Refers to actions and reactions that occur outside of an individual, observable to others.