Question

A risk analyst is building risk scenarios for a new cloud-based payroll platform. The analyst has drafted a scenario describing a threat actor exploiting a misconfigured storage bucket to exfiltrate employee salary data. Before adding this scenario to the risk register for analysis, what is the MOST important step the analyst should take?

Accepted Answer

Validate that the scenario is relevant and plausible for the organization's actual environment and threat landscape

Answer

Calculate the annualized loss expectancy (ALE) for the scenario immediately

Answer

Assign a risk owner and define the treatment option before analysis begins

Answer

Escalate the scenario to the board of directors for approval