nerdexam
(ISC)2

CGRC · Question #134

The potential impact is low if-The loss of confidentiality, integrity, or availability could be expected to have a............... Response:

The correct answer is A. limited adverse effect on organizational operations, organizational assets, or individuals. This question asks for the definition of a 'low' potential impact in terms of adverse effects on an organization or individuals. A low impact is characterized by a 'limited adverse effect.'

Security and Privacy Governance, Risk Management, and Compliance Program

Question

The potential impact is low if-The loss of confidentiality, integrity, or availability could be expected to have a............... Response:

Options

  • Alimited adverse effect on organizational operations, organizational assets, or individuals.
  • BSevere or catastrophic adverse effect on organizational operations, organizational assets, or
  • Cno adverse effect on organizational operations, organizational assets, or individuals.
  • Dserious adverse effect on organizational operations, organizational assets, or individuals

How the community answered

(29 responses)
  • A
    93% (27)
  • B
    3% (1)
  • D
    3% (1)

Why each option

This question asks for the definition of a 'low' potential impact in terms of adverse effects on an organization or individuals. A low impact is characterized by a 'limited adverse effect.'

Alimited adverse effect on organizational operations, organizational assets, or individuals.Correct

According to NIST FIPS 199 and NIST SP 800-60, a low impact level is defined as a situation where the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. This implies minor damage, degradation, or harm.

BSevere or catastrophic adverse effect on organizational operations, organizational assets, or

A 'severe or catastrophic adverse effect' describes a high impact level.

Cno adverse effect on organizational operations, organizational assets, or individuals.

'No adverse effect' would imply no impact at all, which is not a defined impact level in standard risk assessments where 'low' still indicates some level of harm.

Dserious adverse effect on organizational operations, organizational assets, or individuals

A 'serious adverse effect' typically describes a moderate or even high impact level, not a low one.

Concept tested: NIST Impact Level Definitions

Source: https://csrc.nist.gov/glossary/term/impact_level

Topics

#Risk Assessment#Impact Analysis#CIA Triad

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice