An information security manager is analyzing a risk that is believed to be severe, but lacks numerical evidence to determine the impact the risk could have on the organization.

An information security manager is analyzing a risk that is believed to be severe, but lacks numerical evidence to determine the impact the risk could have on the organization.

In this case the information security manager should:
A . use a qualitative method to assess the risk.
B . use a quantitative method to assess the risk.
C . put it in the priority list in order to gain time to collect more data.
D . ask management to increase staff in order to collect more evidence on severity.

View Answer

Answer: A