CYBERSECURITY MANAGEMENT FINAL
COMPLETE EXAM REVIEW WITH FULL
SOLUTIONS
●● Cybersecurity Risk Management
Answer: is a set of policies, processes, and controls to protect the
organization's information assets from security incidents.
●● Who leads Cybersecurity Risk Management?
Answer: CIO
CISO
other IS managers
●● Risk Assessment
Answer: 1. Identify and analyze potential risk that may negatively
impact an organization or its stakeholders
2. make judgment on the acceptance or tolerability of the risks.
●● Framework for Risk Assessment
Answer: Risk identification: vulnerability
,Risk estimation: level or severity
Risk evaluation: business impact
●● Risk Assessment Formula
Answer: Cybersecurity risk=f(vulnerability, severity, impact)
●● vulnerability
Answer: is the likelihood of a cybersecurity incident
●● Severity
Answer: the level of risk associated with the incident
●● Impact
Answer: the business loss caused by the incident
●● National Cyber Incident Scoring System (NCISS)
Answer: is designed to provide a repeatable and consistent mechanism
for estimating the risk of an incident.
●● Risk Treatment Strategies
Answer: Risk Reduction (Defense and Mitigation)
, Risk transference
Risk acceptance
Risk termination
●● Defense (avoidance)
Answer: attempts to prevent the exploitation of the vulnerability.
●● Mitigation
Answer: is the treatment approach that focuses on planning and
preparation to reduce the impact or potential consequences of an
incident or disaster.
●● Common Defense Methods?
Answer: Application of policy (e.g., ISP)
Application of SETA programs
Implementation of technology
●● 4 Mitigation Plans
Answer: Business continuity (BC) plan
Disaster recovery (DR) plan
COMPLETE EXAM REVIEW WITH FULL
SOLUTIONS
●● Cybersecurity Risk Management
Answer: is a set of policies, processes, and controls to protect the
organization's information assets from security incidents.
●● Who leads Cybersecurity Risk Management?
Answer: CIO
CISO
other IS managers
●● Risk Assessment
Answer: 1. Identify and analyze potential risk that may negatively
impact an organization or its stakeholders
2. make judgment on the acceptance or tolerability of the risks.
●● Framework for Risk Assessment
Answer: Risk identification: vulnerability
,Risk estimation: level or severity
Risk evaluation: business impact
●● Risk Assessment Formula
Answer: Cybersecurity risk=f(vulnerability, severity, impact)
●● vulnerability
Answer: is the likelihood of a cybersecurity incident
●● Severity
Answer: the level of risk associated with the incident
●● Impact
Answer: the business loss caused by the incident
●● National Cyber Incident Scoring System (NCISS)
Answer: is designed to provide a repeatable and consistent mechanism
for estimating the risk of an incident.
●● Risk Treatment Strategies
Answer: Risk Reduction (Defense and Mitigation)
, Risk transference
Risk acceptance
Risk termination
●● Defense (avoidance)
Answer: attempts to prevent the exploitation of the vulnerability.
●● Mitigation
Answer: is the treatment approach that focuses on planning and
preparation to reduce the impact or potential consequences of an
incident or disaster.
●● Common Defense Methods?
Answer: Application of policy (e.g., ISP)
Application of SETA programs
Implementation of technology
●● 4 Mitigation Plans
Answer: Business continuity (BC) plan
Disaster recovery (DR) plan
