1. Home
2. All questions
3. Question 16

CISSP study material · question 16 of 500

An agency system publishes public transit timetables. A falsified timetable would seriously mislead riders, an outage would merely inconvenience them, and the data is already public. The system owner wants one impact rating covering the whole system. How should the categorisation be performed?

• Asset security
• Risk management

1. Rate the potential damage for confidentiality alone, since the other objectives are addressed by continuity planning.
2. Rate the potential damage separately for each objective, then average the three levels into a single system rating.
3. Rate the potential damage separately for confidentiality, integrity and availability, then record all three impact levels.
4. Rate the potential damage once for the system as a whole using the objective the system owner considers dominant.

Challenge yourself on this topic → Study as cards