The county risk register lists a 911 CAD outage as high impact even though its likelihood is low. How should the analyst use that when prioritizing Enterprise Security detections?
Select an answer to reveal the explanation.
Short Explanation
A 911 CAD outage is like a bridge collapse: rare, but if it happens the county stops moving. Low likelihood is not a hall pass to skip detections on something that painful. Keep the two knobs separate so high-impact civic systems still get coverage.
Full Explanation
When the county risk register lists a 911 CAD outage as high impact even though likelihood is low, Analysts should keep impact and likelihood separate so CAD still receives high-impact detections despite low likelihood. Public-safety systems that are rare to fail can still justify strong Enterprise Security coverage because the civic consequence of failure is extreme. Collapsing the two knobs into "probably fine" abandons critical infrastructure monitoring.
Removing CAD from monitoring because low likelihood means the asset can be ignored fails by concept: low likelihood does not erase high impact. Folding impact into likelihood and dropping standalone impact fails by concept: the register deliberately separates those dimensions. Treating the outage as low priority because rare events never need dedicated detections fails by concept: rarity is not a hall pass to skip coverage on life-safety systems.
Exam caveat: High-impact/low-likelihood civic assets still deserve dedicated detections; do not let likelihood alone drive deprioritization.
Operational check: Map CAD-related sourcetypes to enabled correlation searches, tag those detections as high-impact in content metadata, and keep CAD on the monitoring exception list that cannot be disabled for "quiet queue" reasons alone.