IT rates a ransomware event as low consequence because 'we have bac…

Question

IT rates a ransomware event as low consequence because 'we have backups,' without verifying restore time or integrity. What rating practice is wrong?

Accepted Answer

Letting unproven mitigations hide the inherent magnitude of the event's consequence. — Saying 'we have backups' is not the same as proving a fast, clean restore. Do not shrink the blast radius on faith. Score the harm honestly, then show how controls cut residual risk.

Answer

Recording ransomware as an information risk instead of a facilities risk.

Answer

Using qualitative words instead of dollars when describing service downtime.

Answer

Including ransomware on the enterprise register rather than a local IT list.

IT rates a ransomware event as low consequence because 'we have backups,' without verifying restore time or integrity. What rating practice is wrong?

Short Explanation

Full Explanation