During a city risk meeting, staff treat a high CVSS number as the complete WLAN risk rating and ignore likelihood and local business impact. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
CVSS is a useful thermometer, not the whole diagnosis. City risk still needs 'will this hit us?' and 'how bad for our services?'—likelihood plus impact, not a number in isolation.
Full Explanation
Domain 2.1.2 risk determination combines likelihood and organizational impact for the WLAN environment. CVSS informs severity but does not encode local exposure, compensating controls, or mission impact. SSID counts and abandoning advisories are not valid risk methodologies.