Tier 2 addresses risk from which perspective?

• A. Mission and Business Process Perspective
• B. Information System Perspective
• C. Governance Perspective
• D. Physical Security Perspective

Answer: (A)

The main idea being tested is how risk is evaluated in terms of how IT supports the organization’s ability to carry out its mission and business processes. In this tier, risk is assessed from the perspective of whether IT-enabled operations, services, and critical workflows can continue effectively. It looks at the potential impact on mission objectives, customer service, revenue, regulatory compliance, and overall operational resilience if information systems fail or are compromised. By focusing on how systems enable or hinder day-to-day business activities, this tier links technical risk to tangible business outcomes rather than just the health of individual IT components. The other perspectives—focusing on the inner workings of the information system, governance and policy, or physical security of facilities—don’t center on the real-world business impact of IT risks in this tier.