Study. uk . com
  1. Home
  2. All questions
  3. Question 288

CISM study material · question 288 of 1000

Which two symptoms does IR 8286 attribute to overconfidence in risk work? Choose two.

  1. Unreasonably low likelihood estimates for threat events
  2. Excessive reliance on threat intelligence feeds bought in from outside
  3. An exaggerated estimation of the organisation's ability to handle a threat
  4. Reluctance to record any risk on the register in case it attracts attention from the auditors
Show the answer

Answer: A. Unreasonably low likelihood estimates for threat events
C. An exaggerated estimation of the organisation's ability to handle a threat

IR 8286's overconfidence shows up as optimism about scenarios: likelihoods pitched too low, opportunity benefits talked up, and the organisation's own capacity to cope with a threat overrated.

Source: NIST IR 8286 (NIST) — Sec. 3.2.2 Determination of Potential Threats

Challenge yourself on this topic → Study as cards