Study. uk . com
  1. Home
  2. All questions
  3. Question 208

CISM study material · question 208 of 1000

An organisation uses a five-level qualitative scale and finds it cannot decide which of eleven high risks to fund first. Which limitation of qualitative assessment does this show?

  1. It requires far more data than the organisation can realistically collect for each of the risks it has already recorded
  2. It cannot be communicated to non-technical decision makers, who need a figure rather than a word before they can act
  3. It cannot represent the intangible aspects of risk, such as the damage done to the organisation's reputation among its own customers
  4. Its comparatively small range of values makes relative prioritisation within the reported set difficult
Show the answer

Answer: D. Its comparatively small range of values makes relative prioritisation within the reported set difficult

SP 800-30 notes qualitative assessment supports communicating results to decision makers, but its comparatively small range of values makes relative prioritisation or comparison within the set of reported risks difficult.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.2 Assessment Approaches

Challenge yourself on this topic → Study as cards