CGRC · Question #133
The assessed potential impact resulting from a compromise of the confidentiality, integrity, or availability of an information type, expressed as a value of low, moderate, or high. Response:
The correct answer is A. Impact Value. The question describes the definition of the assessed potential impact as an 'Impact Value,' which is a categorization (low, moderate, high) used in risk assessments. This term specifically refers to the qualitative or quantitative assignment to the magnitude of harm.
Question
The assessed potential impact resulting from a compromise of the confidentiality, integrity, or availability of an information type, expressed as a value of low, moderate, or high. Response:
Options
- AImpact Value
- BPotential Impact
- CImpact Result
- DNone
How the community answered
(21 responses)- A95% (20)
- B5% (1)
Why each option
The question describes the definition of the assessed potential impact as an 'Impact Value,' which is a categorization (low, moderate, high) used in risk assessments. This term specifically refers to the qualitative or quantitative assignment to the magnitude of harm.
An 'Impact Value' is the specific term used in many risk assessment frameworks, including NIST, to denote the qualitative or quantitative expression (e.g., low, moderate, high) of the severity of harm resulting from a security event affecting confidentiality, integrity, or availability. This value is assigned after assessing the potential impact.
'Potential Impact' refers to the possibility or scope of harm, but 'Impact Value' is the specific categorization assigned to that potential.
'Impact Result' is a general phrase that doesn't capture the specific categorization or assignment of a value as precisely as 'Impact Value'.
There is a correct term described by the definition.
Concept tested: Risk Assessment Terminology - Impact Value
Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.