Book Image

Certified Information Security Manager Exam Prep Guide - Second Edition

By : Hemang Doshi
Book Image

Certified Information Security Manager Exam Prep Guide - Second Edition

By: Hemang Doshi

Overview of this book

CISM is a globally recognized and much sought-after certification in the field of IT security. This second edition of the Certified Information Security Manager Exam Prep Guide is up to date with complete coverage of the exam content through comprehensive and exam-oriented explanations of core concepts. Written in a clear, succinct manner, this book covers all four domains of the CISM Review Manual. With this book, you’ll unlock access to a powerful exam-prep platform which includes interactive practice questions, exam tips, and flashcards. The platform perfectly complements the book and even lets you bring your questions directly to the author. This mixed learning approach of exploring key concepts through the book and applying them to answer practice questions online is designed to help build your confidence in acing the CISM certification. By the end of this book, you'll have everything you need to succeed in your information security career and pass the CISM certification exam with this handy, on-the-job desktop reference guide.
Table of Contents (12 chapters)

Differentiating Risk Capacity, Risk Appetite, and Risk Tolerance

The first step toward understanding risk management is to learn the following three important terms:

  • Risk capacity: This is the maximum risk an organization can afford to take.
  • Risk tolerance: Risk tolerance levels are acceptable deviations from the risk appetite.
  • Risk appetite: This is the amount of risk that an organization is willing to take.

The following example further explains these terms.

Mr. A's total savings are $1,000. He wants to invest in equities to earn some income. Since he is risk averse, he decides to invest only up to $700. If the markets are good, he is willing to invest a further $50. In terms of risk capacity, risk appetite, and risk tolerance, the following can be derived:

  • Risk capacity: Total amount available, i.e., $1,000
  • Risk appetite: Mr. A's willingness to take a risk i.e., $700
  • Risk tolerance: Acceptable deviation from the risk appetite...