Exam CISSP topic 1 question 103 discussion

I would go D, you need to inventory assets before you can value them.

Inventory first

The correct answer is C. Asset valuation list. Here's the reasoning: Physical Loss Control Process: This process aims to protect an organization's physical assets from various threats like theft, damage, or natural disasters. Importance of Asset Valuation: Before implementing any protective measures, it's crucial to understand what needs to be protected and the value of those assets. An asset valuation list provides a detailed inventory of assets along with their estimated financial worth. Why other options come later: Inventory List (D): While an inventory list is essential, it doesn't include the critical valuation component necessary to prioritize loss control measures. Security Standards List (B): Standards are developed based on understanding your assets and determining appropriate security controls. Deterrent Controls List (A): Deterrent controls are designed to discourage potential threats, a step that comes after asset valuation.

You can't value assets that you have no inventory of.

Inventory list. https://www.cisa.gov/sites/default/files/publications/isc-planning-managing-physical-security-resources-dec-2015-508.pdf Section: 4 Resource Requirements

Inventory must exist in first place

Answer D) Inventory List This is a Chicken-or-the-Egg scenario. Asset Valuation is the first step in the process...but it can not be started without first creating an inventory list of assets and then go through the process of putting a value on it. https://www.isaca.org/resources/isaca-journal/issues/2017/volume-3/it-asset-valuation-risk-assessment-and-control-implementation-model

The key security management practices necessary to assess risk can be broken into six broad steps : 1. Asset identification 2. Risk assessment (Asset Valuation) 3. Policy development 4. Implementation 5. Training and education

the documentation produced FIRST when performing an effective physical loss control process is: C. Asset valuation list. The asset valuation list is an essential document in the physical loss control process. It involves assessing the value of an organization's assets, including equipment, inventory, facilities, and resources. The asset valuation helps determine the importance and worth of each asset, which in turn assists in prioritizing security measures based on their value and criticality. By creating an asset valuation list as the first step, organizations can identify high-value assets that require enhanced protection and allocate resources accordingly. This list provides a foundation for implementing appropriate physical security measures and helps guide decision-making in risk management and loss prevention strategies.

D. Inventory list The first step in an effective physical loss control process is to conduct an inventory of the organization's assets. This includes identifying, cataloging, and valuing all physical assets that are important to the organization. The inventory list should include a description of each asset, its location, and its value. This information is used to identify the most critical assets that need to be protected and to prioritize security measures. The inventory list serves as the foundation for the rest of the physical loss control process, providing a clear understanding of the assets that need to be protected and the potential risks that they may face.

I figured out why most of the answers on this website are wrong.

I choose C. The effective physical loss control process is knowing the asset value to calculate the loss expectancy (ALE = SLE x ARO and SLE = Asset Value x Exposure Factor)

I believe the key in the question here is word "effective": (effective physical loss control process). ! Asset valuation should be the answer. Because this list is not any list, but it is driven from risk analysis process.

Answer is D. This is all part of ITAM (IT Asses Management).

Agree with D.

Asset Identification, Valuation and Categorization of information systems assets are critical tasks of the process to properly develop and deploy the required security control for the specified IT assets. Assett Valutation include the value of an asset depends on the sensitivity of data inside the container and their potential impact on CIA, effective keyword I think it's correct C

You need to know what you have , then the value for each item.