Difference Between Quantitative and Qualitative Assessments:
* Quantitative Assessment: Provides measurable data, often expressed in monetary terms, to quantify risk impact.
* Qualitative Assessment: Uses descriptive categories (e.g., high, medium, low) to assess risk based on subjective judgment.
Why Option A Is Correct:Quantitative assessments focus on precise calculations, such as potential financial loss, which is a distinguishing feature.
Why Other Options Are Incorrect:
* B & D: These describe qualitative assessments, not quantitative.
* C. Mapping to Business Objectives: Both types can be mapped to objectives; this is not a distinguishing factor.
References:EC-Council describes quantitative methods as data-driven and focused on objective metrics, while qualitative methods emphasize subjective risk prioritization.

Comprehensive and Detailed Explanation:
The CCISO framework assigns ultimate oversight and accountability for the information security program to senior leadership. Auditors assess, CISOs manage, but executives own risk acceptance and governance.