Study. uk . com
  1. Home
  2. All questions
  3. Question 210

CISM study material · question 210 of 1000

An organisation scores risks from 0 to 100 but states the numbers carry no meaning outside the assessment. Which approach is this?

  1. Deterministic
  2. Qualitative
  3. Semi-quantitative
  4. Quantitative
Show the answer

Answer: C. Semi-quantitative

SP 800-30's semi-quantitative approach uses bins, scales or stand-in numbers that carry no meaning beyond the assessment, yet still map back to qualitative terms decision makers can act on.

Source: NIST SP 800-30 Rev. 1 (NIST) — Sec. 2.3.2 Assessment Approaches

Challenge yourself on this topic → Study as cards