Study. uk . com
  1. Home
  2. All questions
  3. Question 254

CISM study material · question 254 of 1000

In the IR 8286 risk register, what does the term exposure denote, and what do other frameworks call the same thing?

  1. The combination of likelihood and impact, which ISO 31000 and SP 800-30 call the level of risk
  2. The residual risk after treatment, which others call target risk
  3. The organisation's total accepted risk across the whole portfolio, which other frameworks call risk capacity
  4. The value of the affected asset, which others call impact
Show the answer

Answer: A. The combination of likelihood and impact, which ISO 31000 and SP 800-30 call the level of risk

IR 8286 uses exposure for the combination of impact and likelihood, and notes other common frameworks use different terms for the same combination, such as level of risk in ISO 31000 and SP 800-30.

Source: NIST IR 8286 (NIST) — Sec. 3 Risk Register Elements

Challenge yourself on this topic → Study as cards