What are the MOST important criteria to consider when developing a data classification scheme to facilitate risk assessment and the prioritization of risk mitigation activities?
Answer(s): C
Data classification is the process of organizing data in groups based on their attributes and characteristics, and then assigning class labels that describe a set of attributes that hold true for the corresponding data sets1. Data classification helps an organization understand the value of its data, determine whether the data is at risk, and implement controls to mitigate risks1. Data classification also helps an organization comply with relevant industry-specific regulatory mandates such as SOX, HIPAA, PCI DSS, and GDPR1. The most important criteria to consider when developing a data classification scheme are the business criticality and sensitivity of the data2. Business criticality refers to the impact of data loss or compromise on the organization's operations, reputation, and objectives2. Sensitivityrefers to the level of confidentiality, integrity, and availability required for the data2. Data that is highly critical and sensitive should be classified and protected accordingly, as it poses the highest risk to the organization if mishandled or breached2.Some of the best practices for data classification are3:Inventory your data: Identify all data assets within your organization. Define data categories: Create a classification scheme that suits your organization's needs. Assign responsibility: Designate individuals or teams responsible for data classification. Implement classification tools: Invest in tools and technologies that facilitate data classification.Educate and train: Raise awareness and provide guidance on data classification policies and procedures.Review and audit: Monitor and evaluate the effectiveness and compliance of data classification.References = What is Data Classification? | Best Practices & Data Types | Imperva, What Is Data Classification? The 5 Step Process & Best Practices for Classifying Data | Splunk, Top 10 Best Practices for Securing Your Database - 2023
Which of the following statements BEST illustrates the relationship between key performance indicators (KPIs) and key control indicators (KCIs)?
Answer(s): B
Key performance indicators (KPIs) are metrics or measures that provide information on the progress and performance of an organization or a team toward an intended result orobjective. KPIs can help to monitor and evaluate the achievement of strategic, operational, or tactical goals, and to support the decision making and improvement of the organization or the team1.Key control indicators (KCIs) are metrics or measures that provide information on the status and effectiveness of the controls or safeguards that are implemented to manage the risks or threats that an organization or a team faces. KCIs can help to identify and assess the strengths and weaknesses of the controls or safeguards, and to ensure the compliance and accountability of the organization or the team2.The statement that best illustrates the relationship between KPIs and KCIs is that KPIs and KCIs both contribute to understanding of control effectiveness, because they can help to:Measure and compare the actual and expected outcomes and impacts of the controls or safeguards, and to determine the gaps or deviations Analyze and understand the causes and consequences of the gaps or deviations, and to identify the root problems or issuesEvaluate and report the performance and compliance of the controls or safeguards, and to communicate the results and feedback to the stakeholders Improve and optimize the design and implementation of the controls or safeguards, and to enhance the efficiency and effectiveness of the risk management process34 The other statements do not illustrate the relationship between KPIs and KCIs accurately, but rather some of the differences or misconceptions between them. KPIs measure manual controls, while KCIs measure automated controls is a difference between KPIs and KCIs, but not a general one. KPIs and KCIs can measure both manual and automated controls, depending on the type and nature of the controls or safeguards.A robust KCI program will replace the need to measure KPIs is a misconception about KPIs and KCIs, as they are not mutually exclusive or substitutable. KPIs and KCIs complement and support each other, as they provide different but related information on the performance and risk management of the organization or the team. KCIs are applied at the operational level while KPIs are at the strategic level is a difference between KPIs and KCIs, but not a universal one. KPIs and KCIs can be applied at different levels of the organization or the team, depending on the scope and purpose of the measurement and evaluation. References =Key Performance Indicator (KPI): Definition, Types, and Examples Key Control Indicators - ISACAKey Control Indicators: What They Are and How to Use Them Key Performance Indicators vs. Key Control Indicators: What's the Difference? [CRISC Review Manual, 7th Edition]
A risk practitioner has just learned about new malware that has severely impacted industry peers worldwide data loss?
The data privacy officer is the best person to notify in case of a new malware that has severely impacted industry peers with data loss. The data privacy officer is responsible for ensuring that the enterprise complies with the applicable privacy laws and regulations, and that the personal data of the customers, employees, and other stakeholders are protected from unauthorized access, use, disclosure, or destruction. The data privacy officer can assess the potential impact of the malware on the enterprise's data privacy obligations and risks, and coordinate the appropriate response and remediation actions. The customer database manager, the customer data custodian, and the audit committee are not the best persons to notify, as they do not have the same level of authority, responsibility, and expertise as the data privacy officer in dealing with data privacy issues. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 191.
A vendor's planned maintenance schedule will cause a critical application to temporarily lose failover capabilities. Of the following, who should approve this proposed schedule?
Answer(s): D
The business application owner is responsible for the application's performance and availability. Therefore, they should approve any maintenance schedules that could impact the application's functionality, including temporary loss of failover capabilities. Their approval ensures that the business implications are considered and that appropriate contingency plans are in place.
ISACA CRISC Review Manual, 7th Edition, Chapter 4: Information Technology and Security, Section: IT Operations and Maintenance.
Key risk indicators (KRIs) BEST support risk treatment when they:
KRIs are most effective when they signal that a risk is nearing or exceeding predefined thresholds. This early warning enables organizations to take proactive measures to mitigate risks before they materialize into significant issues.
ISACA CRISC Review Manual, 7th Edition, Chapter 3: Risk Response and Reporting, Section: Key Risk Indicators.
Post your Comments and Discuss ISACA CRISC exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CRISC content, but please register or login to continue.