Question

A risk analyst is reviewing entries in the enterprise risk register before quarterly reporting. One entry reads: 'Cyberattack could harm the company.' The analyst wants to improve the usefulness of this entry so that risk owners can prioritize treatment and track it over time. Which improvement should the analyst recommend FIRST?

Accepted Answer

Rewrite the entry to describe a specific threat, the vulnerability it exploits, the affected asset, and the potential business impact

Answer

Assign a monetary annualized loss expectancy (ALE) figure to the entry immediately

Answer

Move the entry to the bottom of the register since it is too vague to act on

Answer

Delete the entry and wait until an actual incident provides more detail