Tier 3 addresses risk from which perspective?

• A. Information System Perspective
• B. Governance Perspective
• C. Mission Perspective
• D. Physical Security Perspective

Answer: (A)

Tier 3 concentrates on risk from the Information System Perspective. This means evaluating how threats, vulnerabilities, and security controls affect the IT assets themselves—the hardware, software, networks, data, and the services the system provides. It looks at the system boundaries, how data flows through the stack, access control and monitoring, incident response, and recovery capabilities, and it assesses risk to the system’s operation and the information it holds. This focus contrasts with governance, which deals with policy and oversight; mission perspective, which considers risk in terms of impact on operational objectives; and physical security, which protects the tangible assets from theft, damage, or tampering. By centering on the information system, Tier 3 ensures risk decisions reflect the actual security posture and resilience of the technology and data involved.