Which statement is true about Tier 3 risk?

• A. It addresses risk from an information system perspective and is guided by the risk decisions at Tiers 1 and Tier 2
• B. It addresses risk from a governance perspective
• C. It addresses risk from a mission perspective
• D. It addresses risk from a physical security perspective

Answer: (A)

Tier 3 risk concentrates on the information system itself—the threats, vulnerabilities, and controls that affect a specific system or program. It translates the high-level risk decisions made at the upper tiers into concrete security actions for the system: selecting and implementing controls, conducting assessments, and continuously monitoring to keep risk within the organization’s tolerance. The decisions and risk appetite set at the higher tiers guide what is acceptable and what needs to be mitigated for the system, ensuring that system-level risk aligns with overall governance and mission objectives.

Choosing a higher-tier focus like governance or mission would miss this system-level emphasis, and physical security, while important, is not the primary lens through which Tier 3 risk is defined.