Study. uk . com
  1. Home
  2. All questions
  3. Question 202

CISM study material · question 202 of 1000

Several moderate risks materialise in the same quarter and the combined loss exceeds anything the organisation had assessed. Which limitation of risk aggregation does this illustrate?

  1. The worst-case upper bound for a discrete risk can fail when risks materialise concurrently or one recurs, exceeding risk capacity
  2. Moderate risks should not be aggregated with each other
  3. Aggregation applies only to adversarial threats
  4. Aggregation always overstates total risk
Show the answer

Answer: A. The worst-case upper bound for a discrete risk can fail when risks materialise concurrently or one recurs, exceeding risk capacity

SP 800-30 notes that while worst-case impact sets an upper bound for a discrete risk, that bound may fail when multiple risks materialise concurrently or the same risk recurs, so overall risk can exceed the organisation's risk capacity.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Aggregation

Challenge yourself on this topic → Study as cards