The security team completed a risk assessment in which it assigned business impact values to each application on its own, without consulting anyone outside IT. Business leaders now dispute the results. What should have been done differently?
Select an answer to reveal the explanation.
Short Explanation
Only the people who run the business know what it'd cost them if a system went dark. You can facilitate from security, but the owners set the impact. The trap is thinking a fancier method or an independent party fixes a problem that's really about who's in the room.
Full Explanation
Impact is the consequence to the business when an asset's confidentiality, integrity or availability is compromised, and the people best placed to judge it are the business process owners who depend on the asset. They understand revenue effects, regulatory exposure, customer harm and operational disruption in ways that IT cannot. The security team's role is to facilitate the assessment, provide consistent scales and challenge assumptions, while the owners provide and stand behind the impact values. That ownership is also what makes the results credible when they are used to justify treatment. Switching to a quantitative method does not solve the problem; numbers chosen by IT without business input remain IT's opinion, merely with false precision. Internal audit is independent so that it can evaluate the process; asking it to assign values would compromise that independence and still lack operational business knowledge. Recovery complexity measures technical effort, which is not the same as business impact; a system that is easy to restore can still be critical. Exam caveat: owners may delegate input to subject matter experts but remain accountable for the values. Operational check: confirm each impact rating in the assessment is attributed to and approved by the named business owner.