Our security vendor just conducted a Risk Assessment for our organisation and has provided us with the report. One of the 'Threats' identified by the vendor is 'Theft', and our 4 office locations have been listed among the assets under the type 'Physical Location'.
In the final report, the probability and frequency of Theft have been given the value of
1 each for our 4 offices. I found it strange that the theft of a physical location is marked as probable, even though the value assigned to that threat is
1 (least probably on a scale of 1-3).
Initially, I assumed the probability has been marked for theft of devices, equipment, or IP by an insider, but those things were identified as different assets and have their own risk estimated for Theft.
My questions are:
1) Is it an industry practice that 'Theft of a physical location' to be given the least value of probability?
2) Is it acceptable in a Risk Assessment to assign a value of zero for the probability of threats like this?
What am I missing?