Study. uk . com
  1. Home
  2. All questions
  3. Question 291

CISM study material · question 291 of 1000

An organisation records only the immediate effect of each risk event. Which analysis does IR 8286 say is also required?

  1. Conversion of each impact figure into a common currency, so that entries from different units can be added together
  2. Identification of cascading risks, where a primary event triggers secondary and even tertiary events
  3. Reclassification of each risk by control family
  4. Assignment of a second risk owner to each entry
Show the answer

Answer: B. Identification of cascading risks, where a primary event triggers secondary and even tertiary events

IR 8286 asks for cascading risks to be traced, where one event sets off a second and that a third, with each link assessed for its own likelihood and impact.

Source: NIST IR 8286 (NIST) — Sec. 3.2.2 Determination of Potential Threats

Challenge yourself on this topic → Study as cards