Practice · BCS Foundation Certificate in Information Security Management Principles

~/bcs-ismp · bcs-ismp_d1_a333c748e1be ▊

← BCS Foundation Certificate in Information Security Management Principles · practice sheet

bcs-ismp_d1_a333c748e1be domain/d1 · medium single

An analyst insists on calculating a precise annualised loss expectancy for every information security threat, but struggles to obtain credible figures for the likelihood of a hacker intercepting company email or the damage that would result. According to the argument presented, why does the classic risk formula break down in this situation?

A The formula only applies to financial losses, not to reputational or operational harm
B Reliable estimates of both the probabilities and the impacts of security events are rarely available, making the situation one of uncertainty rather than risk
C Risk must always be expressed as a percentage, not a monetary value
D The formula requires regulatory approval before it can be applied to information security

Unlock this exam to join the per-question discussion and vote on questions.

next question →