ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Under FIPS 199, a moderate impact is assigned when a loss of confidentiality, integrity, or availability could result in a serious adverse effect on organizational operations or assets, including significant financial loss or noticeable service disruption, but not catastrophic consequences such as loss of life. The scenario describes substantial monetary loss and operational disruption without life-threatening outcomes, matching the definition of moderate impact. A low impact would imply only limited adverse effects, while a high impact would involve severe or catastrophic effects such as shutdown of critical functions or potential loss of life. "Not categorized" is not an allowable designation once an impact has been identified.