An assessor plans to score likelihood and impact on ordinal bands of low, moderate and high, with no monetary values attached. Under NIST SP 800-30, which assessment approach is this?

Question

Answer 1

Show the answer

Answer: A. Qualitative.

SP 800-30 allows quantitative, qualitative and semi-quantitative approaches, and the approach fixes the values a factor may take. Threat-oriented is an analysis approach, not an assessment approach.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 > 2.3 Risk Assessment