The common practice, when it is difficult to calculate the financial losses, is to take a qualitative approach, in which the manager affected by the risk defines the financial loss in terms of a weighted factor {e.g., one is a very low impact to thebusiness and five is a very high impact). An ROI is computed when there is predictable savings or revenues that can be compared to the investment needed to realize the revenues. Amortization is used in a profit and loss statement, not in computing potential losses. Spending the time needed to define exactly the total amount is normally a wrong approach. If it has been difficult to estimate potential losses (e.g., losses derived from erosion of public image due to a hack attack), that situation is not likely to change, and at the end of the day, the result will be a not well-supported evaluation.

Section: Protection of Information Assets
Explanation:
Federal Information Processing Standards (FIPS) are publicly announced standards developed by the
United States Federal government for use by all nonmilitary government agencies and by government
contractors. Many FIPS standards are modified versions of standards used in the wider community.

Section: Protection of Information Assets

Section: Protection of Information Assets
Explanation:
With public key encryption or asymmetric encryption, data is encrypted by the sender using the recipient's
public key; the data is then decrypted using the recipient's private key.