- Home
- All questions
- Question 210
CISM study material · question 210 of 1000
An organisation scores risks from 0 to 100 but states the numbers carry no meaning outside the assessment. Which approach is this?
Show the answer
Answer: C. Semi-quantitative
SP 800-30's semi-quantitative approach uses bins, scales or stand-in numbers that carry no meaning beyond the assessment, yet still map back to qualitative terms decision makers can act on.
Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.2 Assessment Approaches