Which of the following is an input used to calculate system-level risk?

The correct answer is B. System vulnerabilities. System-level risk is calculated based on factors such as threats, likelihood, and vulnerabilities. System vulnerabilities are a direct input into risk calculation, whereas risk appetite, KRIs, and BIA are used for governance, monitoring, or impact analysis rather than…

Submitted by amina.ke· Apr 18, 2026Information Security Risk Management

Question

Options

ASystem risk appetite
BSystem vulnerabilities
CKey risk indicators (KRIs)
DBusiness impact analysis (BIA)

How the community answered

(31 responses)

A
3% (1)
B
94% (29)
C
3% (1)

Explanation

System-level risk is calculated based on factors such as threats, likelihood, and vulnerabilities. System vulnerabilities are a direct input into risk calculation, whereas risk appetite, KRIs, and BIA are used for governance, monitoring, or impact analysis rather than determining inherent system

Topics

#Risk calculation#System risk#Vulnerabilities#Risk inputs

Community Discussion

No community discussion yet for this question.

Full CISM Practice