IT rates a ransomware event as low consequence because 'we have backups,' without verifying restore time or integrity. What rating practice is wrong?
Select an answer to reveal the explanation.
Short Explanation
Saying 'we have backups' is not the same as proving a fast, clean restore. Do not shrink the blast radius on faith. Score the harm honestly, then show how controls cut residual risk.
Full Explanation
Unproven mitigations must not hide the inherent magnitude of an event's consequence. Rating ransomware low consequence because "we have backups" without verifying restore time or integrity lets assumed controls mask impact on civic services. Recording ransomware as information risk rather than facilities risk is classification, not the stated error. Using qualitative downtime words instead of dollars can be acceptable. Including ransomware on the enterprise register is appropriate. Exam caveat: assess consequence (and residual after tested controls); do not equate hoped-for mitigations with reduced inherent impact without evidence. Operational check: run a timed restore test for a critical city system backup, document recovery point and time objectives met or missed, then set consequence and residual ratings from those results. Brief IT and the risk committee together on the verified—not assumed—position. In municipal practice, record the rationale in the risk procedure or committee minutes so future staff apply the same rule under budget pressure. Re-validate after the next seasonal peak or org-chart change to confirm the civic control still holds as designed for residents and staff.