Which risk assessment methodologies are provided as examples?

Which risk assessment methodologies are provided as examples?

• A. ITIL, COBIT, and ITSA
• B. SSAE 18, SOC 2, and ISO 9001
• C. OCTAVE, ISO 27005, and NIST SP 800-30
• D. PMI PMBOK and PRINCE2

Answer: (C)

Risk assessment methodologies are structured approaches to identify, analyze, and prioritize information security risks so an organization can decide on controls. The best choice lists OCTAVE, ISO 27005, and NIST SP 800-30 because they are well-known frameworks specifically used for conducting risk assessments in information security. OCTAVE guides organizations to assess risk from an organizational perspective, focusing on assets, threats, and vulnerabilities across people, processes, and technology, and then estimating impact and likelihood to determine risk levels. ISO 27005 provides a formal risk management process aligned with ISO 27001, detailing how to identify risks, analyze and evaluate them, and determine appropriate treatment. NIST SP 800-30 offers a practical guide for risk assessments, outlining the steps from defining the scope to identifying threats and vulnerabilities, assessing impact and likelihood, and producing a risk determination and plan of action. Together, these three exemplify methodologies designed to systematically measure and respond to information security risk. Other options point to frameworks not primarily used for risk assessment in this context: ITIL, COBIT, and ITSA are governance and IT management frameworks; SSAE 18, SOC 2, and ISO 9001 relate to audits, controls, and quality management; PMI PMBOK and PRINCE2 are project management methodologies.

Risk assessment methodologies are structured approaches to identify, analyze, and prioritize information security risks so an organization can decide on controls. The best choice lists OCTAVE, ISO 27005, and NIST SP 800-30 because they are well-known frameworks specifically used for conducting risk assessments in information security. OCTAVE guides organizations to assess risk from an organizational perspective, focusing on assets, threats, and vulnerabilities across people, processes, and technology, and then estimating impact and likelihood to determine risk levels. ISO 27005 provides a formal risk management process aligned with ISO 27001, detailing how to identify risks, analyze and evaluate them, and determine appropriate treatment. NIST SP 800-30 offers a practical guide for risk assessments, outlining the steps from defining the scope to identifying threats and vulnerabilities, assessing impact and likelihood, and producing a risk determination and plan of action. Together, these three exemplify methodologies designed to systematically measure and respond to information security risk.

Other options point to frameworks not primarily used for risk assessment in this context: ITIL, COBIT, and ITSA are governance and IT management frameworks; SSAE 18, SOC 2, and ISO 9001 relate to audits, controls, and quality management; PMI PMBOK and PRINCE2 are project management methodologies.