Study. uk . com
  1. Home
  2. All questions
  3. Question 270

CISM study material · question 270 of 1000

A risk committee treats cybersecurity risk as a self-contained category with no bearing on other enterprise risks. Which example does IR 8286 use to challenge that view?

  1. A cybersecurity breach always triggers a regulatory penalty, which is what carries it into the enterprise portfolio
  2. Cybersecurity risk cannot be quantified in financial terms
  3. Cybersecurity risk is a subset of operational risk
  4. A cybersecurity breach can result in a credit downgrade or a loss of public confidence
Show the answer

Answer: D. A cybersecurity breach can result in a credit downgrade or a loss of public confidence

IR 8286 places cybersecurity and credit risk in different parts of the enterprise portfolio, then points out a breach can trigger a downgrade or cost public confidence — the categories do not stay separate.

Source: NIST IR 8286 (NIST) — Sec. 2.2.3 Focus on the System Level

Challenge yourself on this topic → Study as cards