CRISC Exam Dumps - Certified in Risk and Information Systems Control

The most important factor to consider when assessing the residual risk of implementing encryption for data at rest is the key management. Key management is the process of generating, storing, distributing, using, and destroying the cryptographic keys that are used to encrypt anddecrypt the data. Key management is essential for ensuring the security, availability, and integrity of the encrypted data, as well as for complying with the legal and regulatory requirements. Poor key management could result in the loss, theft, compromise, or corruption of the keys, which could lead to unauthorized access, data breach, data loss, or data recovery failure. Therefore, key management must be considered to assess the residual risk, which is the risk that remains after the risk treatment, such as encryption, is applied. Data retention requirements, data destruction requirements, and cloud storage architecture are not as important as key management, as they do not directly affect the encryption and decryption of the data, and they may not introduce significant residual risk. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

A post-implementation RCSA is a process of verifying whether the risk treatment plan has been executed as intended and whether the residual risk is within the acceptable level. It involves testing the effectiveness of the controls that have been implemented to mitigate the risk and identifying any gaps or issues that need to be addressed. A BIA, the original risk response plan, and the training program and user awareness documentationare not sufficient to validate theeffectiveness of the risk treatment plan, as they do not measure the actual performance of the controls or the residual risk.

Key risk indicators (KRIs) are metrics that provide information on the level of exposure to a given operational risk1. KRIs have upper and lower acceptable risk limits (warning thresholds) that trigger actions when exceeded2. These thresholds are based on the organization’s risk appetite or tolerance, which is the amount and type of risk that the organization is willing to accept in pursuit of its objectives3. Therefore, changes in risk appetite or tolerance would prompt changes in KRI thresholds, as the organization would need to adjust its risk monitoring and response accordingly. The other options are not the primary factors that would prompt changes in KRI thresholds, although they may have some influence on the risk management process. References = Risk IT Framework; IT Risk Resources; ISACA Risk Starter Kit; Key Risk Indicators; Key Risk Indicators: A Practical Guide

ï‚· Zero Trust Architecture:

Zero Trust is a security concept centered on the belief that organizations should not automatically trust anything inside or outside their perimeters and must verify everything attempting to connect to their systems.

ï‚· Basic Tenets of Zero Trust:

The primary principle is "never trust, always verify." This means every access request is authenticated, authorized, and encrypted regardless of where it originates.

Zero Trust requires securing all communication, whether it occurs within the internal network or comes from external sources. This approach prevents lateral movement by potential attackers who have breached the network perimeter.

ï‚· Key Components:

Authentication and Authorization:Continuous verification of user identities and access privileges.

Microsegmentation:Dividing the network into small, isolated segments to limit the spread of threats.

Encryption:Ensuring that all data, whether at rest or in transit, is encrypted to protect its confidentiality and integrity.

ï‚· Other Options:

Incoming Traffic Inspection:While important, this is just one aspect of Zero Trust.

Security Frameworks and Libraries:These are tools and guidelines to implement security but do not define the core tenets of Zero Trust.

Digital Identities:Implementing digital identities is part of the broader Zero Trust strategy but not a standalone tenet.

ï‚· References:

The CISSP Study Guide explains the Zero Trust architecture and its emphasis on securing all communications regardless of network location (Sybex CISSP Study Guide, Chapter 8: Principles of Security Models, Design, and Capabilities)​​.

According to the CRISC Review Manual (Digital Version), the next course of action when a risk practitioner finds the IT department’s recovery time objective (RTO) for a key system does not align with the enterprise’s business continuity plan (BCP) is to consult with the IT department to update the RTO. The RTO is the maximum acceptable time that an application, computer, network, or system can be down after an unexpected disaster, failure, or comparable event takes place. The RTO should be aligned with the BCP, which is a set of policies, procedures, and resources that enable the organization to continue or resume its critical business functions in the event of a disruption. Consulting with the IT department to update the RTO helps to:

Ensure that the RTO reflects the current business requirements and expectations for the availability and recovery of the key system

Evaluate the feasibility and cost-effectiveness of achieving the RTO with the existing IT resources and capabilities

Identify and implement the necessary changes or improvements in the IT infrastructure, processes, and controls to meet the RTO

Test and validate the RTO and the IT recovery procedures and verify their compatibility and consistency with the BCP

Communicate and coordinate the RTO and the IT recovery plan with the relevant stakeholders, such as the business owner, the risk owner, and the senior management

References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.3: Risk Response Options, pp. 174-1751

 Reduced ability to evaluate key risk indicators (KRIs) will have the greatest impact on the ability to monitor risk when an information system for a key business operation is moved from an in-house application to a Software as a Service (SaaS) vendor, as it may limit the visibility and control over the risk exposure and performance of the system. KRIs are metrics that measure the level of risk exposure and the effectiveness of risk response strategies, and they should be aligned with the enterprise’s risk appetite and objectives. When the system is moved to a SaaS vendor, the enterprise may lose access to the data and processes that are used to calculate and report the KRIs, or the KRIs may become irrelevant or inconsistent with the vendor’s environment and standards. This may impair the ability to monitor risk and to take timely and appropriate actions to manage risk. Reduced access to internal audit reports, dependency on the vendor’s key performance indicators (KPIs), and dependency on service level agreements (SLAs) are not the greatest impacts on the ability to monitor risk, as they do not affect the measurement and reporting of the risk status and performance, but rather the assurance and evaluation of the system quality and reliability. References = CRISC Certified in Risk andInformation Systems Control – Question221; ISACACertified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 221.

The risk practitioner’s best recommendation after recovery steps have been completed is B. Perform a root cause analysis. A root cause analysis is a process of identifying and assessing the underlying causes of a problem or an incident. By performing a root cause analysis, the risk practitioner can help the organization to understand how and why the cyber attack happened, what vulnerabilities and gaps were exploited, and what actions and controls can be implemented to prevent or mitigate similar incidents in the future12

A root cause analysis can also help the organization to improve its incident response plan, which is a set of instructions to help IT staff detect, respond to, and recover from network security incidents3 A root cause analysis can provide valuable feedback and lessons learned from the cyber attack, and help the organization to update and test its incident response plan accordingly45

Developing new key risk indicators, recommending the purchase of cyber insurance, and reviewing the incident response plan are all possible actions that the risk practitioner can take after a cyber attack, but they are not the best recommendation. Developing new key risk indicators can help the organization to monitor and measure its risk exposure and performance, but it does not address the root causes of the cyber attack12 Recommending the purchase of cyber insurance can help the organization to hedge against the financial losses caused by cyber incidents, but it does not prevent or solve the underlying issues67 Reviewing the incident response plan can help the organization to evaluate its effectiveness and identify areas for improvement, but it does not explain how and why the cyber attack occurred345

Therefore, the best recommendation is to perform a root cause analysis, as it can help the organization to understand, resolve, and prevent the cyber attack and its consequences12