A risk-assessment approach that applies a standard set of controls drawn from a code of practice, with no per-asset analysis at all, is the __________ approach.
A risk-assessment approach that applies a standard set of controls drawn from a code of practice, with no per-asset analysis at all, is the __________ approach.
Answer
baseline
Options - A. baseline - B. informal - C. detailed risk analysis - D. combined Why - A. Correct — a general level of controls, no assessment, a floor everywhere and blind to variation in exposure. - B. Informal is also quick, but it DOES analyse: internal experts or consultants apply judgement to this organisation. That is the whole difference. - C. Detailed is the formal five-stage process applied asset by asset — the opposite of no analysis. - D. Combined is baseline everywhere PLUS detailed analysis of the systems a high-level pass flags. Baseline and informal are both the quick ones, which is why they are confused. The test: baseline applies a standard control set with no analysis; informal applies expert judgement with no formal method.
Stallings & Brown 5e ch14 §14.1–14.4; ISO/IEC 27000 family (27001, 27002, 27005); ISO 13335