Information asset classification is the process of assigning a level of sensitivity and criticality to an information asset based on its value, importance, and impact to the organization. The major reason to classify information assets is to determine their sensitivity and criticality, which are the measures of how confidential, proprietary, or sensitive the information is, and how essential, urgent, or time-sensitive the information is for the business operations. By determining the sensitivity and criticality of information assets, the organization can prioritize the protection and recovery of the information assets, implement the appropriate security controls and safeguards, comply with the regulatory and contractual requirements, and manage the information lifecycle and disposal. References = CRISC Review Manual, 7th Edition, page 74.

is incorrect. Process integrity is confirmed within the system, it dose not need monitoring. Answer: D is incorrect. System changes are compared from a previous state to the current state, it dose not correlate information from multiple sources. Answer: C is incorrect. Configuration settings are generally compared against predefined values and not based on the correlation between multiple souces.

A control assessment is the process of evaluating the design and effectiveness of controls that are implemented to mitigate risks. A control assessment can help identify the root causes of data loss, the gaps in the existing controls, and the potential solutions to improve the control environment. A control assessment should be conducted after identifying a high probability of data loss in a system, as it can provide valuable information for risk response and reporting. References = Risk and Information Systems Control Study Manual, Chapter 3:
Risk Response and Mitigation, Section 3.2: Control Assessment, p. 147-149.

Section: Volume D

Explanation/Reference:
Explanation:
As quantitative analysis is data driven, it:
Allows data classification and counting.

Allows statistical models to be constructed, which help in explaining what is being observed.

Generalizes findings for a larger population and direct comparisons between two different sets of data

or observations.
Produces statistically reliable results.

Allows discovery of phenomena which are likely to be genuine and merely occurs by chance.

Incorrect Answers:
A: Risk factors are expressed in terms of high/medium/low in qualitative analysis, and not in quantitative analysis.