Question

A newly formed startup has limited historical loss data and no budget for detailed financial modeling. The CISO must present a prioritized list of risks to the executive board within one week, ranking each risk by relative severity so leadership can decide where to focus early security investment. Which risk assessment approach is MOST appropriate for this situation?

Accepted Answer

Qualitative assessment using a probability-and-impact matrix with descriptive severity ratings

Answer

Quantitative assessment calculating ALE from SLE and ARO for each identified risk

Answer

A full FAIR-based Monte Carlo simulation to derive loss exceedance curves

Answer

Deferring the assessment until at least twelve months of incident data has been collected