Study. uk . com
  1. Home
  2. All questions
  3. Question 193

CISM study material · question 193 of 1000

An analyst must estimate the likelihood of a hardware failure rather than an attack. Which basis does SP 800-30 prescribe?

  1. Adversary intent and capability
  2. The severity of the associated vulnerability
  3. The organisation's risk appetite statement
  4. Historical evidence and empirical data
Show the answer

Answer: D. Historical evidence and empirical data

SP 800-30 reserves intent, capability and targeting for adversarial events. Everything else — failure, error, accident — is judged from what has happened before and from empirical data.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Likelihood

Challenge yourself on this topic → Study as cards