Senior management wants risk scenarios that show how information security events could prevent the company from achieving its strategic objectives, so they can be discussed at the executive level. Which approach to scenario development BEST fits this purpose?
Select an answer to reveal the explanation.
Short Explanation
If the boss asks 'what could stop us hitting our goals?', you start from the goals and work down. That's top-down. The trap is bottom-up lists of systems and threats, which are useful for engineers but won't land in a boardroom conversation about strategy.
Full Explanation
Risk scenarios can be developed top-down or bottom-up, and the choice depends on purpose. A top-down approach begins with the enterprise's objectives and asks which events could prevent them from being achieved, producing scenarios framed in business terms such as loss of a key market, regulatory sanction or failure of a strategic program. That framing suits executive discussion and links information security risk directly to strategy. A bottom-up approach starts from assets and threats, which is valuable for thoroughness and operational detail but tends to produce many technical scenarios that executives cannot readily connect to objectives. Building a scenario around every scan finding confuses vulnerabilities with risk and produces an unmanageable list without business framing. Building scenarios around control failures starts from the existing control set, so it can miss risks for which no control exists and still does not express impact on objectives. Exam caveat: mature programs often use both approaches and reconcile them, since top-down scenarios can overlook detail that bottom-up analysis surfaces. Operational check: confirm each executive-level scenario names the business objective it threatens, an accountable owner and an estimated impact expressed in business terms.