An IT security manager is asked to provide the total risk to the business. Which of the following
calculations would he security manager choose to determine total risk?
A.
(Threats X vulnerability X asset value) x controls gap
B.
(Threats X vulnerability X profit) x asset value
C.
Threats X vulnerability X control gap
D.
Threats X vulnerability X asset value
Explanation:
Threats X vulnerability X asset value is equal to asset value (AV) times exposure factor (EF). This
is used to calculate a risk.