?

Question

A. A risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.
B. A risk treatment strategy that attempts to reduce the impact of the loss caused by a realized incident, disaster, or attack through effective contingency planning and preparation.
C. A risk treatment strategy that indicates the organization is willing to accept the current level of risk, is making a conscious decision to do nothing to protect an information asset from risk, and accepts the outcome from any resulting exploitation.
D. A risk treatment strategy that eliminates all risk associated with an information asset by removing it from service.
E. The quantity and nature of risk that organizations are willing to accept.
F. The formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization.
G. The financial savings from using the defense risk treatment strategy to implement a control and eliminate the financial ramifications of an incident.
H. A process of assigning financial value or worth to each information asset.
I. An examination of how well a particular solution fits within the organization's strategic planning objectives and goals.
J. The calculated value associated with the most likely loss from a single attack.

Answer 1

A. defense risk treatment strategy
B. mitigation risk treatment strategy
C. acceptance risk treatment strategy
D. termination risk treatment strategy
E. risk appetite
F. cost-benefit analysis
G. cost avoidance
H. asset valuation
I. organizational feasibility
J. single loss expectancy