In risk calculation, which term represents the percentage of an asset's value that would be lost during a security incident or disaster?

In risk calculation, which term represents the percentage of an asset's value that would be lost during a security incident or disaster?

• A. Exposure factor (EF)
• B. Risk tolerance
• C. Environmental variables
• D. CVSS

Answer: (A)

Exposure factor is the portion of an asset's value that would be lost if a security incident occurs. It’s used in risk calculations to scale the asset’s value to the expected loss from a specific threat event. For example, if an asset is valued at $100,000 and the exposure factor is 0.25, the potential loss from the incident is $25,000 (Single Loss Expectancy = Asset Value × Exposure Factor). This concept is also used alongside the annualized rate of occurrence to estimate broader losses over time (Annualized Loss Expectancy). The other terms don’t describe the fraction of asset value lost: risk tolerance is how much risk the organization is willing to accept, environmental variables are surrounding physical/operational factors, and CVSS is a vulnerability severity scoring system, not a measure of asset-value loss.

Exposure factor is the portion of an asset's value that would be lost if a security incident occurs. It’s used in risk calculations to scale the asset’s value to the expected loss from a specific threat event. For example, if an asset is valued at $100,000 and the exposure factor is 0.25, the potential loss from the incident is $25,000 (Single Loss Expectancy = Asset Value × Exposure Factor). This concept is also used alongside the annualized rate of occurrence to estimate broader losses over time (Annualized Loss Expectancy). The other terms don’t describe the fraction of asset value lost: risk tolerance is how much risk the organization is willing to accept, environmental variables are surrounding physical/operational factors, and CVSS is a vulnerability severity scoring system, not a measure of asset-value loss.