Exam CISA topic 1 question 486 discussion

Answer: A option A focuses specifically on evaluating the potential consequences or impact of identified risks. This assessment helps management understand the severity of each risk scenario, enabling them to prioritize mitigation efforts and allocate resources accordingly option C alone does not provide management with specific information on how to mitigate risks.

C. Risk Classification

I think its.. C. Identify the owner and custody of the asset. Identify and list information systems assets of the organization. (List all interfacing applications, people, hardware or other containers for each asset.) Containers are the place where an information asset or data “lives” or any type of information asset (data) is stored transported or processed.3 Identify the security objectives of confidentiality, integrity and availability (CIA) and a weighting of the asset to conduct an impact assessment based upon the criticality of the asset to the operation of the company. Identify the asset’s security categories and its estimated value. Determine the threat and vulnerability’s quantitative value and rates. Estimate the probability of occurrence/likelihood of impact. Identify existing controls and perform a gap analysis