Which of the following is MOST important to update when an organization's risk appetite changes?
Answer(s): A
The most important element to update when an organization's risk appetite changes is the key risk indicators (KRIs). KRIs are metrics that provide an early warning of increasing risk exposure in various areas of the organization. They help to monitor the level of risk and to trigger risk responses when the risk exceeds the risk appetite. The risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk reportingmethodology, key performance indicators (KPIs), and risk taxonomy are other elements that may be updated, but they are not as important as the KRIs. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.
A risk practitioner has been asked to evaluate the adoption of a third-party blockchain integration platform based on the value added by the platform and the organization's risk appetite. Which of the following is the risk practitioner's BEST course of action?
Conducting a risk assessment with stakeholders is the best course of action for the risk practitioner to evaluate the adoption of a third-party blockchain integration platform, because it helps to identify, analyze, and evaluate the risks and opportunities associated with the platform, and to compare them with the organization's risk appetite and value proposition. A risk assessment is a process of systematically identifying and assessing the sources and types of risk that an organization faces, and estimating their likelihood and impact. A risk assessment also involves identifying and evaluating the existing or proposed controls or mitigating factors that can reduce or eliminate the risk. A stakeholder is a person or group that has an interest or influence in the organization or its activities, such as customers, employees, shareholders,suppliers, regulators, or partners. A blockchain integration platform is a software solution that enables the organization to connect and interact with blockchain networks or applications, such as cryptocurrencies, smart contracts, or distributed ledgers. A blockchain integration platform can offer benefits such as transparency, security, efficiency, and innovation, but it can also pose risks such as technical complexity, interoperability issues, regulatory uncertainty, or cyberattacks. Therefore, conducting a risk assessment with stakeholders is the best way to evaluate the adoption of a third-party blockchain integration platform, as it helps to understand the benefits and risks of the platform, and to align them with the organization's objectives and risk appetite. Conducting third-party resilience tests, updating the risk register with the process changes, and reviewing risk related to standards and regulations are all important tasks to perform after conducting a risk assessment, but they are not the best course of action, as they depend on the results of the risk assessment.References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87
A maturity model is MOST useful to an organization when it:
Answer(s): C
A maturity model is a framework that describes the stages or levels of development and improvement of a certain domain, such as a process, a function, or an organization. A maturity model is most useful to an organization when it provides a reference for progress, meaning that it helps the organization to assess its current state, identify its strengths and weaknesses, set its goals and objectives, and measure itsperformance and improvement over time. A maturity model can also help the organization to compare itself with best practices and standards, but benchmarking against other organizations is not its primary purpose. A maturity model can also help the organization to manage its risks, but defining a qualitative measure of risk or providingrisk metrics is not its main function. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.2.1, p. 118-119
Which of the following is the MOST useful information an organization can obtain from external sources about emerging threats?
·External sources of emerging threats are sources that provide information about the latest cyberattacks, hacking techniques, malware, and vulnerabilities that can affect an organization's IT systems and data. Examples of external sources are security blogs, forums, newsletters, reports, and alerts from reputable organizations such as ISACA, Imperva, Aura, and BitSight123.·The most useful information an organization can obtain from external sources is the indicators for detecting the presence of threats. Indicators are observable signs or patterns that can help identify, prevent, or mitigate cyberattacks. Examples of indicators are IP addresses, domain names, file hashes, network traffic, system logs, and user behavior4. ·Indicators for detecting the presence of threats are more useful than the other options because they can help an organization to:oMonitor and analyze its IT environment for any suspicious or malicious activity oRespond quickly and effectively to any potential or actual incidents oReduce the impact and damage of cyberattacks oImprove its security posture and resilience·Solutions for eradicating emerging threats are not the most useful information because they may not be applicable or effective for every organization, depending on its specific context, needs,and resources. Moreover, solutions may not be available or known for some new or sophisticated threats.·Cost to mitigate the risk resulting from threats is not the most useful information because it does not help an organization to identify or prevent cyberattacks. Cost is only one factor to consider when deciding how to manage IT risk, and it may not reflect the true value or impact of the threats.·Source and identity of attackers are not the most useful information because they may not be relevant or accurate for every organization. Source and identity of attackers are often difficult to trace or verify, and they may not affect the organization's risk level or response strategy.References =·Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, Chapter 2:IT Risk Assessment, Section 2.3: Risk Identification, pp. 83-84 ·Risk and Information Systems Control Review Questions, Answers & Explanations Database, 12 Month Subscription, ISACA, 2020, Question ID: 100000
Who should be PRIMARILY responsible for establishing an organization's IT risk culture?
Answer(s): B
Executive management should be primarily responsible for establishing an organization's IT risk culture, as they have the authority and accountability to define and communicate the vision, mission, values, and objectives of the organization, and to set the tone and direction for the IT risk management and control processes. Executive management is the highest level of management in an organization, and it consists of the board of directors, the chief executive officer (CEO), and other senior executives. Executive management is responsible for the strategic planning and decision making of the organization, and for ensuring the alignment of the organizational strategy and objectives with the stakeholder expectations and requirements.Executive management should be primarily responsible for establishing an organization's IT risk culture by providing the following benefits:It demonstrates the leadership and commitment of the executive management to the IT risk management and control processes, and to the achievement of the organizational strategy and objectives.It influences and motivates the behavior and attitude of the staff and managers towards IT risk management and control, and fosters a culture of risk awareness, ownership, and accountability across the organization.It defines and communicates the IT risk appetite and tolerance of the organization, and guides and supports the development and implementation of the IT risk policies, standards, and procedures.It allocates and monitors the resources and performance of the IT risk management and control processes, and ensures the effectiveness and efficiency of the IT risk governance and oversight.The other options are not the primary choices for establishing an organization's IT risk culture. Business process owner is the person who has the responsibility and authority over the design, execution, and performance of a specific business process, and they are accountable for the risks and controls associated with their process, but they do not have the overall or strategic responsibility for the IT risk culture. Risk management is the function or department that is responsible for managing and monitoring the IT risk management and control processes, and for providing advice and guidance to the executive management and the business units, but they do not have the ultimate or final responsibility for the IT risk culture. ITmanagement is the function or department that is responsible for managing and maintaining the IT operations and security, and for supporting the IT risk management and control processes, but they do not have the highest or broadest responsibility for the IT risk culture. References = Risk Culture - Open Risk Manual, IT Risk Resources | ISACA, The 6 key elements to creating and maintaining a good risk culture
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.