Do you use qualitative or quantitative methods to evaluate risk?

Quantitative

Qualitative

Neither

Do you use heat maps to convey risk to you senior leadership?

Yes

No

Do you use FAIR methodology?

Yes

No

Have you heard about or read any of these books? (check all that apply)

Measuring and Managing Information Risk: A FAIR Approach by Jack Freund and Jack Jones

How to Measure Anything in Cybersecurity Risk by Douglas W. Hubbard and Richard Seiersen

Superforecasting: The Art and Science of Prediction,” by Philip Tetlock and Dan Gardner.

Do you present risk assessments to your senior leadership or to the board?

Yes

No

If you answered "Yes" to the previous question, do you offer them a chance to say whether they accept the risk presented or wish to reduce the risk to something smaller?

Yes

No