Question

A risk analyst at a mid-sized bank is estimating the likelihood of a ransomware event for the risk register. The organization has been operating for only three years and has experienced no ransomware incidents, so internal historical loss data is sparse. Management wants a defensible frequency estimate. Which approach BEST improves the credibility of the likelihood estimate?

Accepted Answer

Supplement the limited internal data with external loss event data and industry threat intelligence for comparable institutions

Answer

Assign a likelihood of 'low' since the bank has never experienced a ransomware incident in its operating history

Answer

Delay the assessment until the bank accumulates at least five years of internal incident data

Answer

Use the maximum possible likelihood value to remain conservative in the absence of data