Question: what are the differences between the top-down and bottom-up approaches to information security?
Answer: The top-down approach analyzes risk by aggregating the impact of internal operational failures while the bottom-up approach analyzes the risks in an individual process using models. ... The top-down approach is simple and not data-intensive whereas the bottom-up approach is complex as well as very data-intensive.