Risk Assessment and Management Questions
Identifying, analyzing, prioritizing, and treating information-security, compliance, and privacy risk. Covers qualitative and quantitative risk assessment methodologies, threat and vulnerability identification, likelihood and impact (and severity-of-harm) scoring, risk registers, and treatment decisions (accept, mitigate, transfer, avoid). Includes privacy-specific assessments such as DPIAs and PIAs: when an assessment is required, how to structure it, and how to weigh likelihood and severity of harm to individuals, plus prioritizing compliance and privacy risk across a portfolio of initiatives. Emphasizes structured, repeatable methodology tied to business context.
You have a limited security budget and a backlog of vulnerabilities, architecture debt, and compliance gaps. Describe a reproducible framework to prioritize which security initiatives to fund for the next two quarters. Explain inputs, scoring approach, stakeholders to involve, and how you would present recommendations to executives.
That is every published Risk Assessment and Management question for Security Architect so far. Browse the other topics in this category, or practice this one interactively.