An organization has identified the need to implement an asset tiering model to establish the appropriate level of impact. Which of the following is the MOST effective risk assessment methodology for a

A qualitative method uses subjective ratings (e.g., low, medium, high) which, while useful for initial assessments, may not provide the precision needed to *establish appropriate levels of impact* for a detailed tiering model.

An industry calibration method compares an organization's risks against industry benchmarks, which can inform risk assessment but is not a standalone *methodology* for establishing asset impact tiers.

A threat-based method focuses on identifying and analyzing threats, but it does not primarily provide the structured framework for *quantifying the impact* of those threats on assets to enable tiering.

A quantitative risk assessment methodology assigns numerical values to assets, threats, vulnerabilities, and their potential impacts and likelihood, allowing for the calculation of specific financial losses or other measurable consequences. This is highly effective for establishing an asset tiering model because it provides a clear, objective, and consistent basis for categorizing assets based on their measurable impact (e.g., in monetary terms) to the organization.