CRISC Practice Questions

Data flow documentation provides insight into how and where data moves, stored, or processed. It

helps identify vulnerable points in the data lifecycle where data loss can occur.

Reference:CRISC Manual – Domain 1: Governance, Slide 240

A primary benefit of engaging the risk owner during the risk assessment process is prioritization of

risk action plans across departments, because this helps to ensure that the most critical and relevant

risks are addressed first, and that the resources and efforts are allocated and coordinated efficiently

and effectively. A risk owner is the person or group who is responsible for the day-to-day

management and mitigation of a specific risk, and who has the authority and accountability to make

risk-related decisions. A risk assessment is the process of identifying, analyzing, and evaluating the

risks that may affect the organization’s objectives, performance, or value. A risk action plan is the set

of actions and tasks that are designed and implemented to reduce the likelihood and impact of a risk,

or to exploit the opportunities that a risk may create. By engaging the risk owner during the risk

assessment process, the organization can benefit from the following advantages:

The risk owner can provide valuable input and feedback on the risk identification, analysis, and

evaluation, based on their knowledge, experience, and perspective of the risk and its context.

The risk owner can help to develop and implement the risk action plan, based on their understanding

of the risk objectives, expectations, and outcomes, and their ability to influence and control the risk

factors and sources.

The risk owner can help to prioritize the risk action plan, based on their assessment of the risk

severity, urgency, and importance, and their consideration of the costs, benefits, and feasibility of

the risk actions.

The risk owner can help to coordinate the risk action plan across departments, by communicating

and collaborating with other risk owners, stakeholders, and resources, and by aligning and

integrating the risk actions with the organization’s strategy, processes, and culture. Reference = Risk

Owners — What Do They Do1

Biometric systems are preventive controls designed to restrict access to authorized personnel only,

thereby proactively mitigating unauthorized access risks. This aligns withAccess and Authentication

Controlprinciples in risk management.

The risk manager’s best course of action when discovering significant vulnerabilities in a commercial

off-the-shelf software product is to review the risk of implementing versus postponing with

stakeholders. This means that the risk manager should assess the potential impact and likelihood of

the vulnerabilities being exploited, as well as the benefits and costs of using the software product.

The risk manager should also consult with the relevant stakeholders, such as the business owners,

the IT department, the security team, and the vendor, to understand their perspectives,

expectations, and requirements. Based on this analysis, the risk manager should decide whether to

proceed with the implementation, delay it until the next release,or look for alternative solutions. The

risk manager should also document and communicate the decision and the rationale behind it, and

monitor the situation for any changes or new developments.

The other options are not the best course of action, because:

Running vulnerability testing tools to independently verify the vulnerabilities is a useful step to

confirm the existence and severity of the vulnerabilities, but it is not sufficient to address the risk.

The risk manager still needs to evaluate the trade-offs between implementing and postponing the

software product, and involve the stakeholders in the decision-making process.

Reviewing the software license to determine the vendor’s responsibility regarding vulnerabilities is

an important step to understand the contractual obligations and liabilities of the vendor, but it is not

enough to mitigate the risk. The risk manager still needs to consider the impact and likelihood of the

vulnerabilities, and the benefits and costs of the software product, and consult with the stakeholders

to decide the best course of action.

Requiring the vendor to correct significant vulnerabilities prior to installation is an unrealistic and

impractical option, as the vendor has already stated that the vulnerabilities will not be corrected

until the next release. The risk manager cannot force the vendor to change their schedule or

priorities, and may risk damaging the relationship with the vendor. The risk manager should instead

work with the vendor to understand the nature and scope of the vulnerabilities, and the expected

timeline and features of the next release, and use this information to inform the risk assessment and

decision-making process.

The best way to determine the value of information assets for risk management purposes is to assess

the loss impact if the information is inadvertently disclosed, as this reflects the potential damage or

harm that the organization may suffer due to a breach of confidentiality, integrity, or availability of

the information. The loss impact can be measured in terms of financial, operational, reputational,

legal, or regulatory consequences, depending on the nature, sensitivity, and criticality of the

information. The loss impact can also help the organization to prioritize the protection and mitigation

of the information assets, and to align the risk management strategy with the business objectives

and risk appetite.

Reference:

•ISACA, IT Asset Valuation, Risk Assessment and Control Implementation Model1

•ISACA, Data Classification: What It Is, Why You Should Care and How to Perform It2

The risk owner is the person who should be accountable for any related losses to the organization,

because they are the person who has the authority and responsibility to manage the risk and its

associated controls.The risk owner is also the person who accepts the risk and its residual level, and

who monitors and reports on the risk status and performance. The IT risk manager, the server

administrator, and the risk practitioner are all involved in the riskmanagement process, but they are

not the person who should be accountable for the risk and its outcomes, as they do not have the

ultimate decision-making power and accountability for therisk. Reference = Risk and Information

Systems Control Study Manual, Chapter 3, Section 3.1.1, page 79

When developing a response plan to address security incidents regarding sensitive data loss, it is

most important to review the data classification policy. A data classification policy is a document that

defines the categories and levels of data based on their sensitivity, value, and criticality, and specifies

the appropriate security measures and handling procedures for each data type. A data classification

policy helps to identify and protect the sensitive data that could be exposed or compromised in a

security incident, and to comply with the relevant laws, regulations, standards, and contracts.

Reviewing the data classification policy is important when developing a response plan, because it

helps to determine the scope, impact, and priority of the security incident, and to select the most

appropriate and effective response actions and strategies. Reviewing the data classification policy

also helps to communicate and coordinate the response plan with the internal and external

stakeholders, such as the data owners, users, custodians, and regulators, and to report and disclose

the security incident as required. The other options are not as important as reviewing the data

classification policy, although they may be part of or derived from the response plan. Revalidating

current key risk indicators (KRIs), revising risk management procedures, and revalidating existing risk

scenarios are all activities that can help to improve or update the risk management process, but they

are not the most important when developing aresponse plan. Reference = Risk and Information

Systems Control Study Manual, Chapter 5, Section 5.3.1, page 5-25.

The information classification policy is the most important document regarding the treatment of

sensitive data, because it defines the categories and criteria for classifying data according to their

sensitivity, confidentiality, and value to the organization, and specifies the appropriate handling and

protection measures for each category. Sensitive data are data that contain personal,proprietary, or

confidential information that may cause harm or damage to the organization or its stakeholders if

disclosed, modified, or destroyed without authorization. An information classification policy helps to

ensure that sensitive data are identified and treated in a consistent and secure manner, and that the

organization complies with the applicable laws andregulations regarding data protection and privacy.

An encryption policy, an organization risk profile, and a digital rights management policy are all

useful documents for the treatment of sensitive data, but they are not the most important

document, as they do not directly address the classification and handling of sensitive data. Reference

= Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.2, page 158

Information security metrics are quantitative or qualitative measures that indicate the performance

and effectiveness of the information security processes, controls, and objectives. The primary goal of

developing information security metrics is to enable continuous improvement of the information

security program and to align it with the business goals and strategy. Information security metrics

can help to identify the strengths and weaknesses of thesecurity program, to monitor and report on

the progress and outcomes of the security initiatives, to evaluate the return on investment and value

of the security activities, and to provide feedback and guidance for improvement actions.

Information security metrics should be relevant, reliable, consistent, and actionable. Reference =

Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.2, p. 116-117

The best measure of the impact of business interruptions caused by an IT service outage is the

sustained financial loss. This is the amount of money that the enterprise loses due to the disruption

of its normal operations, such as lost revenue, increased expenses, or reduced profits. Sustained

financial loss reflects the extent and severity of the business interruption, and theeffect on the

enterprise’s objectives and performance. Sustained financial loss also helps to determine the

recovery objectives and priorities, and to justify the investment in risk mitigation and business

continuity strategies. Reference = Risk and Information Systems Control Study Manual, 7th Edition,

Chapter 2, Section 2.2.2, page 691