A CISO must conduct risk assessments using a method where the Chief Financial Officer (CFO)...

Quantitative risk assessments provide financial impact data by assigning numerical values to risk factors, such as the likelihood and impact of events. This method calculates potential losses in monetary terms, making it suitable for presenting actionable insights to a CFO. Qualitative assessments (D) rely on subjective descriptions and are less precise for financial decision-making. Hybrid (B) or subjective (C) methods are not as focused on financial quantification as quantitative assessments.