Risk Evaluation

In the risk evaluation phase, the level of each risk is compared with acceptable risk criteria. If the risk is within the acceptable level, then it is accepted as it is. If the risk exceeds the acceptable level, then the treatment will be some form of mitigation.

Risk Ranking

A risk with a high impact is ranked higher and given priority. The process of ranking risk in terms of its criticality is known as risk analysis. More resources are allocated to high-risk areas. Ranking each risk based on impact and likelihood is critical in determining the risk mitigation strategy. Ranking the risk helps the organization determine its priority.

Practice Question Set 9

1. As an information security manager, you are required to close the vulnerabilities identified by external auditors. What will the most effective way to mitigate the vulnerabilities be?
   1. All vulnerabilities should be addressed immediately
   2. Mitigation should be based on threat, impact, and cost considerations...