Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?
Answer(s): C
The most important topic to cover in a risk awareness training program for all staff is the policy compliance requirements and exceptions process. This topic would help the staff to understandthe enterprise's risk policies, standards, and procedures, and how they apply to their roles and responsibilities. It would also help the staff to know the process for requesting, approving, and documenting any exceptions to the policies, and the consequences of non-compliance. This topic would enhance the staff's risk awareness and responsibility,and foster a culture of compliance and accountability within the enterprise. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.4.1, page 2491
Which of the following should be the PRIMARY focus of a disaster recovery management (DRM) framework and related processes?
Ensuring Timely Recovery of Critical Business Operations:Primary Focus: The primary focus of a Disaster Recovery Management (DRM) framework is to ensure that critical business operations can be recovered and resumed in a timely manner after a disruption.Business Continuity: Timely recovery of operations is essential for maintaining business continuity and minimizing the impact of disruptions on the organization's ability to deliver products and services.Recovery Objectives: Establishing clear recovery time objectives (RTOs) and recovery point objectives (RPOs) ensures that critical operations are prioritized and recovery efforts are aligned with business needs.Comparison with Other Options:Restoring IT and Cybersecurity Operations: While important, this is part of the broader goal of recovering critical business operations.Assessing Impact and Probability of Disaster Scenarios: This is a preparatory step that informs the DRM framework but is not the primary focus. Determining Capacity for Alternate Sites: This is a component of the DRM strategy but supports the primary focus of ensuring timely recovery.Best Practices:Comprehensive Planning: Develop comprehensive disaster recovery plans that prioritize the recovery of critical business operations.Regular Testing: Regularly test and update disaster recovery plans to ensure they remain effective and aligned with business objectives.Cross-Functional Collaboration: Involve all relevant business units in disaster recovery planning to ensure a coordinated and effective response.
CRISC Review Manual: Emphasizes the importance of focusing on the recovery of critical business operations to ensure business continuity. ISACA Guidelines: Recommend prioritizing the timely recovery of critical operations as the primary goal of disaster recovery management efforts.
The PRIMARY objective of a risk identification process is to:
Answer(s): B
The primary objective of a risk identification process is to determine threats and vulnerabilities, which are the sources and causes of the risks that may affect the organization'sobjectives. Threats are any events or circumstances that have the potential to harm or exploit the organization's assets, such as people, information, systems, processes, or infrastructure1. Vulnerabilities are any weaknesses or gaps in the organization's capabilities, controls, or defenses that may increase the likelihood or impact of the threats2. By determining threats and vulnerabilities, the organization can:Identify and document all possible risks, regardless of whether they are internal or external, current or emerging, or positive or negative3.Understand the nature and characteristics of the risks, such as their sources, causes, consequences, and interrelationships4.Provide the basis for further risk analysis and evaluation, such as assessing the probability and severity of the risks, and prioritizing the risks according to their significance and urgency5.References =Threat - CIO WikiVulnerability - CIO WikiRisk Identification - CIO WikiRisk Identification and Analysis - The National Academies Press Risk Analysis - CIO Wiki
An organization's risk practitioner learns a new third-party system on the corporate network has introduced vulnerabilities that could compromise corporate IT systems. What should the risk practitioner doFIRST?
The first thing that the risk practitioner should do upon learning that a new third-party system on the corporate network has introduced vulnerabilities that could compromise corporate IT systems is to notify information security management. This will help to escalate the issue to the appropriate authority and responsibility level, and to initiate the incident response process. Information security management can also coordinate with the third party, the IT department, and other stakeholders to assess the impact and severity of the vulnerabilities, and to implement the necessary actions to contain, eradicate, and recover from the incident. Confirming the vulnerabilities with the third party, identifying procedures to mitigate the vulnerabilities, and requesting IT to remove the system from the network are not the first things that the risk practitioner should do, as they may not address the urgency and priority of the issue, and may not involve the relevant decision makers and responders. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1.2, page 19311: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 659.
Which of the following outcomes of disaster recovery planning is MOST important to enable the initiation of necessary actions during a disaster?
Defining recovery time objectives (RTOs) and acceptable data loss thresholds is critical for effective disaster response, ensuring recovery activities are aligned with business priorities.This supportsBusiness Continuity Planning.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.