Question

A risk practitioner is conducting a risk assessment for a customer-facing e-commerce platform. During the initial data-gathering phase, the practitioner discovers that the asset inventory used to scope the assessment only lists production servers and databases, but omits the CI/CD pipeline, cloud storage buckets holding customer data, and third-party payment integration components. What is the GREATEST concern this poses to the validity of the risk assessment?

Accepted Answer

Threats and vulnerabilities affecting unlisted assets will not be identified or analyzed, understating overall risk exposure

Answer

The residual risk calculations will be delayed until control testing is completed

Answer

The qualitative rating scale will need to be converted to a quantitative one

Answer

The business impact analysis will overstate recovery time objectives for listed assets