Hi all,

I am currently studying for the CISSP, whilst also relating the information to my work circumstances. For me, it makes the information easier to digest!

So, currently reading about Risk analysis and am getting stuck on the Exposure factor percentages.

An example I read - The fire service was able to determine that if a fire broke out in x building, it would cause 70% damage to the building, meaning the exposure factor is 70% - easy...

Work scenario - We have a NAS device in the server room with £5million worth of data. How would I calculate the exposure factor against, say it being attacked by a hacker and losing all this data? Just to add, we have a replication offsite, but this lowers the overall risk, but I guess, doesn't lower the EF on the original?

Any help would be appreciated