Question

A newly hired CISO at a mid-size manufacturing firm is establishing an enterprise risk program. The board has requested a risk assessment of a proposed cloud migration, but the firm lacks historical loss data for cloud-related incidents and has limited time before the next board meeting. The CISO must produce a prioritized view of risks that stakeholders across engineering, legal, and finance can quickly understand and validate. Which risk assessment approach is MOST appropriate given these constraints?

Accepted Answer

Conduct a qualitative assessment using likelihood-and-impact ratings with a risk matrix to rank risks

Answer

Perform a fully quantitative assessment calculating ALE for each identified risk before the board meeting

Answer

Defer the assessment until at least three years of cloud incident loss data can be collected internally

Answer

Rely solely on the cloud provider's SOC 2 report as the basis for the risk determination