ITPEC IP October 2019 Question 45
When risk management in information security is divided into risk identification, risk analysis, risk assessment, and risk treatment, which of the following is included in risk treatment?
Explanation
Selecting how to deal with each risk and planning the specific controls — that is risk treatment, the step after the risks have been found and ranked.
The four steps in the question run in order:
- Risk identification — find the risks that exist in the organization
- Risk analysis — calculate each risk's level from its likelihood and its impact
- Risk assessment (evaluation) — compare each level with the risk acceptance criteria and decide which risks need controls
- Risk treatment — choose a response for each risk (reduce, avoid, transfer or accept) and plan the controls that carry it out
Answer (d)
Why not others:
- •(a) — finding the risks that exist is risk identification, the first step
- •(b) — comparing risk levels with the acceptance criteria to decide whether controls are needed is risk assessment (evaluation), which decides that something must be done but not what
- •(c) — calculating the level from probability and impact is risk analysis
Key rule: Identify, analyse and evaluate decide which risks matter; treatment decides what to do about them (reduce, avoid, transfer, accept).
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.