nerdexam
(ISC)2

CGRC · Question #545

A condition that exists within an organization, a mission/business process, enterprise architecture, or information system including its environment of operation, which contributes to (i.e…

The correct answer is A. Predisposing Condition. The description accurately defines a predisposing condition, which is a factor that increases or decreases the likelihood or impact of adverse threat events within an organization or system environment.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

A condition that exists within an organization, a mission/business process, enterprise architecture, or information system including its environment of operation, which contributes to (i.e., increases or decreases) the likelihood that one or more threat events, once initiated, will result in undesirable consequences or adverse impact to organizational operations and assets, individuals, other organizations, or the Nation. Response:

Options

  • APredisposing Condition
  • BUnsusceptibility Condition
  • CAbnormality Condition
  • DDisposing Condition

How the community answered

(42 responses)
  • A
    88% (37)
  • B
    2% (1)
  • C
    7% (3)
  • D
    2% (1)

Why each option

The description accurately defines a predisposing condition, which is a factor that increases or decreases the likelihood or impact of adverse threat events within an organization or system environment.

APredisposing ConditionCorrect

A predisposing condition is an existing factor or state within an environment (organizational, process, or system) that influences the probability or severity of an undesirable outcome from a threat event. These conditions can either contribute to an increased vulnerability or susceptibility, or conversely, to increased resilience, thereby affecting the overall risk profile. The provided definition precisely matches this concept, describing an inherent situation that affects risk.

BUnsusceptibility Condition

'Unsusceptibility Condition' is not a recognized term in IT risk management and suggests an opposite meaning of invulnerability.

CAbnormality Condition

'Abnormality Condition' is not a standard term in IT risk management for factors influencing risk likelihood or impact.

DDisposing Condition

While 'disposing' might seem related, 'predisposing condition' is the established and formally defined term within risk management frameworks for this concept.

Concept tested: Risk management terminology - predisposing condition

Source: https://nvlpubs.nist.gov/nistpubs/ir/NIST.IR.8286.pdf

Topics

#risk management terminology#predisposing conditions#security concepts#threat events

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice