The formal decision-making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n) __________.
A) ARO
B) CBA
C) ALE
D) SLE

Question

The formal decision-making process used when considering the economic feasibility of implementing information security controls and safeguards is called a(n) __________.
A) ARO
B) CBA 
C) ALE
D) SLE

Quizplus · Accepted Answer

CBA (Cost-Benefit Analysis) is the formal decision-making process used when considering the economic feasibility of implementing information security controls and safeguards. It involves weighing the anticipated costs of implementing a security measure against the potential benefits of not experiencing a security incident. ARO (Annualized Rate of Occurrence), ALE (Annualized Loss Expectancy), and SLE (Single Loss Expectancy) are metrics used in risk assessment, but do not specifically relate to the economic feasibility of security controls.

The Formal Decision-Making Process Used When Considering the Economic Feasibility