CRISC IT Risk Assessment Practice Question

In the FAIR framework, loss magnitude (LM) is composed of primary loss and secondary loss. Which of the following is an example of secondary loss?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Lost business due to reputation damage

Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Incident response costs
Why it's wrong here
Incident response costs are incurred directly while handling the affected asset, placing them in primary response cost rather than secondary loss. It is tempting because response spending is substantial and incident-driven, but secondary loss captures reactions of secondary stakeholders — regulators, customers and partners — after the event.
✓
Lost business due to reputation damage
Why this is correct
Lost business from reputation damage is a secondary loss because it is a consequential, stakeholder-driven effect rather than the direct primary loss from the threat event itself. FAIR separates these: primary loss hits the affected asset, while secondary loss captures reactions such as customer defection, satisfying the stem's requirement for a secondary-loss example.
✗
Legal notification costs
Why it's wrong here
Notification costs are direct costs of a breach, primary loss.
✗
System restoration expenses
Why it's wrong here
System restoration expenses arise directly from responding to and recovering the affected asset, forming primary response cost rather than secondary loss. It is tempting because restoration is expensive and follows an incident, yet secondary loss covers stakeholder reactions such as fines, lawsuits and reputation damage.

Go deeper