Study. uk . com
  1. Home
  2. All questions
  3. Question 203

CISM study material · question 203 of 1000

When aggregating risks, an analyst treats each entry as independent. Which relationship does SP 800-30 ask them to consider?

  1. Whether risks are coupled or correlated, so that one materialising makes another more or less likely
  2. Whether the risks were identified in the same assessment, since entries from one exercise share its assumptions
  3. Whether risks share the same owner
  4. Whether risks are recorded on the same register
Show the answer

Answer: A. Whether risks are coupled or correlated, so that one materialising makes another more or less likely

SP 800-30 asks organisations aggregating risk to consider relationships among discrete risks, including cause and effect, and notes risks with direct or inverse relationships can be coupled qualitatively or correlated quantitatively.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.1 Risk Models — Aggregation

Challenge yourself on this topic → Study as cards