Study. uk . com
  1. Home
  2. All questions
  3. Question 107

CISSP study material · question 107 of 500

A risk register records impact only as the cost of restoring service after an outage. Under NIST SP 800-30, what is missing from that definition of impact?

  1. Harm from unauthorised disclosure and from unauthorised modification or destruction of information.
  2. The adversary's intent and capability in causing the outage.
  3. The likelihood that the outage occurs in the assessment period.
  4. The predisposing conditions that made the outage more probable.
Show the answer

Answer: A. Harm from unauthorised disclosure and from unauthorised modification or destruction of information.

Impact is the magnitude of harm from unauthorised disclosure, unauthorised modification, destruction, or loss of availability. Restoration cost captures only part of the availability consequence.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3.1 Impact

Challenge yourself on this topic → Study as cards