ISC2 Governance, Risk and Compliance (CGRC) Practice Question

FIPS 199 defines a low impact for confidentiality as a loss that could be expected to have only a limited adverse effect-for example, causing minor financial loss or a noticeable but not mission-stopping reduction in effectiveness. Because the assessor determined that disclosure would merely create minor financial loss and some degradation of operations without shutting them down, this aligns with the definition of a limited adverse effect. Moderate impact would require a serious adverse effect such as significant financial loss or major operational disruption, while high impact involves severe or catastrophic consequences. "Not Applicable" is incorrect because FIPS 199 requires every security objective to be categorized at one of the three impact levels.