Which term describes the risk that service may be lost or data are not accessible when needed?

Which term describes the risk that service may be lost or data are not accessible when needed?

• A. Integrity Risk
• B. Relevance Risk
• C. Investment (Or Expense) Risk
• D. Availability Risk

Answer: (D)

Availability risk is the risk that a service or data is not accessible when needed. This concept is part of the CIA triad, focusing on ensuring that systems and information are available for use when required. When availability is compromised, operations can grind to a halt, customers can’t access services, and data cannot be retrieved, leading to downtime, financial loss, and reputational harm. This differs from integrity risk, which concerns data being altered or corrupted, and from confidentiality risk, which involves unauthorized disclosure. It also isn’t about the costs of controls itself; it’s about the risk of unavailability. Causes of availability risk include hardware failures, power outages, network disruptions, software defects, capacity shortfalls, and cyber incidents like DDoS attacks or ransomware. Mitigation focuses on designing for resilience: redundant infrastructure, high-availability configurations, failover capabilities, regular backups, geographically dispersed data centers, robust disaster recovery and business continuity plans, proactive monitoring, and testing of recovery procedures. Key measures include uptime, mean time to recover (MTTR), recovery time objective (RTO), and recovery point objective (RPO) to define and assess acceptable availability levels.

Availability risk is the risk that a service or data is not accessible when needed. This concept is part of the CIA triad, focusing on ensuring that systems and information are available for use when required. When availability is compromised, operations can grind to a halt, customers can’t access services, and data cannot be retrieved, leading to downtime, financial loss, and reputational harm. This differs from integrity risk, which concerns data being altered or corrupted, and from confidentiality risk, which involves unauthorized disclosure. It also isn’t about the costs of controls itself; it’s about the risk of unavailability.

Causes of availability risk include hardware failures, power outages, network disruptions, software defects, capacity shortfalls, and cyber incidents like DDoS attacks or ransomware. Mitigation focuses on designing for resilience: redundant infrastructure, high-availability configurations, failover capabilities, regular backups, geographically dispersed data centers, robust disaster recovery and business continuity plans, proactive monitoring, and testing of recovery procedures. Key measures include uptime, mean time to recover (MTTR), recovery time objective (RTO), and recovery point objective (RPO) to define and assess acceptable availability levels.