Which term denotes the percentage of asset value likely to be lost in a security incident?

Which term denotes the percentage of asset value likely to be lost in a security incident?

• A. Risk tolerance
• B. Exposure factor (EF)
• C. Secure baseline
• D. CVE

Answer: (B)

Exposure factor represents the portion of an asset’s value that would be lost if a security incident occurs. It’s expressed as a percentage or fraction and is a key part of risk calculations—specifically, the single loss expectancy is computed as asset value multiplied by the exposure factor. For example, if an asset is worth $100,000 and the exposure factor is 40%, the expected loss from that incident would be $40,000. Other terms don’t describe the potential magnitude of loss: risk tolerance is about how much risk an organization is willing to accept, a secure baseline is a set of standard controls, and CVE is simply a catalog of known vulnerabilities.

Exposure factor represents the portion of an asset’s value that would be lost if a security incident occurs. It’s expressed as a percentage or fraction and is a key part of risk calculations—specifically, the single loss expectancy is computed as asset value multiplied by the exposure factor. For example, if an asset is worth $100,000 and the exposure factor is 40%, the expected loss from that incident would be $40,000. Other terms don’t describe the potential magnitude of loss: risk tolerance is about how much risk an organization is willing to accept, a secure baseline is a set of standard controls, and CVE is simply a catalog of known vulnerabilities.