Certified in Risk and Information Systems Control (CRISC) — Question 1202

A risk practitioner discovers that a data center's air conditioning system cannot provide sufficient cooling. What else is MOST important to consider when predicting the probability of adverse business impact from this issue?

Answer options

• A. Maintenance history
• B. Compensating controls
• C. Replacement cost
• D. Applicable threats

Correct answer: D

Explanation

Identifying applicable threats is critical because it helps assess the potential risks that could arise from the inadequate cooling system. While maintenance history, compensating controls, and replacement cost are important, they do not directly address the external and internal threats that could exploit the cooling issue and lead to business impact.