Which of the following should be done FIRST when information is no longer required to support business objectives?
Answer(s): C
A retention policy is a set of rules and guidelines that define how long and under what conditions the information should be kept or disposed of by the organization, based on its value, sensitivity, and legal or regulatory requirements. When information is no longer required to support business objectives, the first thing that should be done is to assess the information against the retention policy. This means that the information should be reviewed and evaluated to determine if it should be retained or deleted, and for how long and by whom.Assessing the information against the retention policy helps to ensure that the information is managed and disposed of in a consistent and compliant manner, that the information is protected from unauthorized access, use, disclosure, modification, or destruction, and that the information is available for future reference or audit purposes if needed.The other options are not the first things that should be done when information is no longer required to support business objectives. They are either secondary or not essential for information management.The references for this answer are:Risk IT Framework, page 28Information Technology & Security, page 22Risk Scenarios Starter Pack, page 20
Which of the following is a PRIMARY reason for considering existing controls during initial risk assessment?
During an initial risk assessment, it is crucial to consider existing controls primarily to determine the current risk level. Here's aUnderstanding Existing Controls:Existing controls are measures already in place to mitigate risks. These controls can include technical, administrative, and physical safeguards designed to protect organizational assets. Knowing what controls are currently in place helps to understand the organization's current defense mechanisms against potential threats.Assessing the Current Risk Level:The current risk level is the risk that remains after considering the effectiveness of existing controls, often referred to as residual risk.By evaluating these controls, one can determine how much risk is actually mitigated and what level of risk remains.For instance, if an organization has implemented firewalls and intrusion detection systems, these controls would reduce the risk of cyber attacks. The effectiveness of these controls will determine the residual risk level.Differentiating Between Risk Types:Inherent Risk:This is the level of risk that exists before any controls are applied. It's the raw risk associated with a particular asset or process. Residual Risk:This is the risk that remains after existing controls have been applied. It's the actual risk that an organization faces after mitigation efforts.Current Risk:This term is often used interchangeably with residual risk but focuses on the risk level at the present moment, considering the existing controls.Primary Objective in Initial Risk Assessment:The primary objective of considering existing controls during the initial risk assessment is to gain an accurate picture of the current risk landscape. This allows risk practitioners to understandwhat additional controls or modifications might be needed to further reduce risk to acceptable levels.Without considering existing controls, the assessment would only reflect the inherent risk, which doesn't provide a realistic view of the organization's risk exposure.
The CRISC Review Manual emphasizes the importance of understanding the current risk level by assessing existing controls (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.9.3 Current Risk).
Before assigning sensitivity levels to information it is MOST important to:
Answer(s): B
Before assigning sensitivity levels to information, it is most important to define the information classification policy. The information classification policy is a document that establishes the criteria, categories, roles, responsibilities, and procedures for classifying information according to its sensitivity, value, and criticality. The information classification policy provides the basis, guidance, and consistency for assigning sensitivity levels to information, and ensures that the information is protected and handled appropriately. The other options are not as important as defining the information classification policy, as they are related to the specific steps, activities, or outputs of the information classification process, not the overall structure and quality of the information classification process. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.4: Key Control Indicators, page 211.
Which of the following would BEST enable a risk-based decision when considering the use of an emerging technology for data processing?
Answer(s): A
The best way to enable a risk-based decision when considering the use of an emerging technology for data processing is to perform a gap analysis. A gap analysis is a technique that compares the current state and the desired state of a process, system, or capability, and identifies the gaps or differences between them. A gap analysis can help to evaluate the benefits, costs, risks, and opportunities of using an emerging technology for data processing, and to determine the feasibility, suitability, and readiness of adopting the emerging technology. The other options are not as helpful as a gap analysis, as they are related to the specific aspects or components ofthe data processing, not the overall assessment and comparison of the current and desired state of the data processing. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.2:IT Risk Identification Methods, page 19.
Which of the following is the BEST approach for selecting controls to minimize risk?
The best approach for selecting controls to minimize risk is to perform a risk assessment. A risk assessment is a process that identifies, analyzes, and evaluates the risks that could affect the organization's objectives or operations. A risk assessment helps to determine the likelihood and impact of the risks, and to prioritize them based on their severity and relevance. A risk assessment also helps to select the most appropriate and effective controls to minimize the risks, such as avoiding, reducing, transferring, or accepting the risks. A risk assessment is the best approach for selecting controls, because it helps to align the controls with the organization's risk profile, risk appetite, and risk objectives, and to ensure that the controls are adequate, suitable, and cost-effective. The other options are not the best approach for selecting controls, although they may be part of or derived from the risk assessment. Industry best practice review, cost-benefit analysis, and control-effectiveness evaluation are all activities that can help to support or improve the control selection, but they are not the best approach for selecting controls. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1, page 4-13.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.