CRISC Exam Dumps - Certified in Risk and Information Systems Control

The key to controlling escalating costs when an organization is having new software implemented under contract is change management, which is the process of identifying, evaluating, approving, and implementing changes to the project scope, schedule, budget, or quality1. Change management can help to control escalating costs by:

Establishing a clear and agreed-upon baseline for the project deliverables, requirements, and expectations, and ensuring that they are aligned with the contract terms and conditions2.

Defining and enforcing a formal and consistent change control process, which includes the roles and responsibilities, the criteria and methods, and the documentation and communication of the changes3.

Assessing and prioritizing the proposed changes, and determining their impact and feasibility, and their alignment with the project objectives and constraints4.

Obtaining the approval and authorization of the relevant stakeholders, such as the project sponsor, the project manager, the contractor, or the customer, before implementing the changes5.

Monitoring and measuring the performance and outcome of the changes, and ensuring that they are delivered within the agreed scope, schedule, budget, and quality6.

References =

Change Management - CIO Wiki

Project Scope Management - CIO Wiki

Change Control - CIO Wiki

Change Impact Analysis - CIO Wiki

Change Approval - CIO Wiki

Change Evaluation - CIO Wiki

The correct answer isAbecause when malware is discovered on an endpoint device, the first consideration in determiningimpactis thecriticality and sensitivity of the affected asset. The business importance of the device, the data it stores or accesses, and the role it plays in operations determine how serious the incident is to the organization.

The other options are less important for determining impact:

B. Currency of anti-malware signaturesrelates to control effectiveness, not the primary measure of business impact.

C. Availability of patches and security updatesis relevant to remediation, but not the main factor in assessing impact.

D. Currency of the incident response planaffects preparedness, not the actual impact of the malware event.

Exact Extracts supporting the answer:

“IT risk is measured by its impact on business operations.”

“The primary reason risk professionals conduct risk assessments is to identify risk with the highest business impact.”

“The main outcome of a business impact analysis (BIA) is the criticality of business processes.”

“To determine the level of protection required for securing personally identifiable information a risk practitioner should PRIMARILY consider the sensitivity property of the information.”

“The criticality of an IT infrastructure element can be quantified based on dependencies.”

These extracts show that impact assessment is driven primarily by business criticality and information sensitivity. Therefore,asset criticality and sensitivityis the primary consideration.

===========

The primary goal of conducting a business impact analysis (BIA) as part of an overall continuity planning process is to identify critical business processes and the degree of reliance on support services. A BIA is a process of assessing the potential impact and consequences of a disruption or interruption of the business activities, operations, or functions. A continuity planning processis a process of developing, implementing, and maintaining a plan to ensure the continuity and recovery of the business activities, operations, or functions in the event of a disruption or interruption. The primary goal of conducting a BIA is to identify critical business processes and the degree of reliance on support services, which are the business processes that are essential for the survival and success of the business, and the support services that are required to enable or facilitate the critical business processes, such as IT systems, human resources, facilities, or suppliers. Identifying critical business processes and the degree of reliance on support services helps to determine the priorities and requirements for the continuity and recovery of the business activities, operations, or functions, and to select and implement the appropriate continuity andrecovery strategies and solutions. Obtaining the support of executive management, mapping the business processes to supporting IT and other corporate resources, and documenting the disaster recovery process are not the primary goals of conducting a BIA, as they are either the benefits or the outputs of the BIA process, and they do not address the primary need of assessing the impact and consequences of the business disruption or interruption. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 50.

During an initial risk assessment, it is crucial to consider existing controls primarily to determine the current risk level. Here ' s a

Understanding Existing Controls:

Existing controls are measures already in place to mitigate risks. These controls can include technical, administrative, and physical safeguards designed to protect organizational assets.

Knowing what controls are currently in place helps to understand the organization’s current defense mechanisms against potential threats.

Assessing the Current Risk Level:

The current risk level is the risk that remains after considering the effectiveness of existing controls, often referred to as residual risk.

By evaluating these controls, one can determine how much risk is actually mitigated and what level of risk remains.

For instance, if an organization has implemented firewalls and intrusion detection systems, these controls would reduce the risk of cyber attacks. The effectiveness of these controls will determine the residual risk level.

Differentiating Between Risk Types:

Inherent Risk:This is the level of risk that exists before any controls are applied. It’s the raw risk associated with a particular asset or process.

Residual Risk:This is the risk that remains after existing controls have been applied. It ' s the actual risk that an organization faces after mitigation efforts.

Current Risk:This term is often used interchangeably with residual risk but focuses on the risk level at the present moment, considering the existing controls.

Primary Objective in Initial Risk Assessment:

The primary objective of considering existing controls during the initial risk assessment is to gain an accurate picture of the current risk landscape. This allows risk practitioners to understandwhat additional controls or modifications might be needed to further reduce risk to acceptable levels.

Without considering existing controls, the assessment would only reflect the inherent risk, which doesn’t provide a realistic view of the organization ' s risk exposure.

The best way to ensure key risk indicators (KRIs) provide value to risk owners is to provide timely notification of the changes in the risk exposure. KRIs are metrics that provide an early warning of increasing risk exposure in various areas of the organization. By providing timely notification of the KRI values, the risk owners can be alerted of the risk situation and take appropriate actions to manage the risk. Ongoing training, return on investment (ROI), and cost minimization are other possible ways to ensure KRIs provide value, but they are not as effective as timely notification. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 10; CRISC Review Manual, 6th Edition, page 140.

The best metric to demonstrate that servers are configured securely is the total number of servers meeting the baseline for hardening. Hardening is the process of applying security configurations and settings to servers to reduce their attack surface and vulnerability. A baseline is a standard or benchmark that defines the minimum level of security required for servers. By measuring the number of servers that meet the baseline, the organization can assess the effectiveness of its hardening efforts and identify any gaps or deviations. The other metrics, such as exceeding availability thresholds, experiencing hardware failures, or exceeding current patching standards, are not directly related to the security configuration of servers, but rather to their performance, reliability, or maintenance. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.2, page 2-25.

Payroll system risk mitigation plans are the actions that are taken to reduce or eliminate the risk associated with payroll processing. When a migration from an in-house developed system to an external cloud-based solution is affecting a previously rated key risk scenario related to payroll processing, the first part of the risk register that should be updated is the payroll system risk mitigation plans. This is because the migration may introduce new risks or change the existing risks, and the risk mitigation plans may need to be revised or replaced accordingly. Updating the payroll system risk mitigation plans can help ensure that the risk level is acceptable and the payroll process is secure and reliable. According to the CRISC Review Manual 2022, one of the key risk treatment techniques is to update the risk action plan, which is a document that outlines the risk mitigation plans1. According to the CRISC Review Questions, Answers & Explanations Manual 2022, updating the risk mitigation plans is the correct answer to this question2.

Payroll system risk factors, payroll process owner, and payroll administrative controls are not the first part of the risk register that should be updated when a migration is affecting a key risk scenario. Payroll system risk factors are the sources or causes of risk, such as threats, vulnerabilities, or uncertainties. Payroll process owner is the person who is responsible for the payroll process and its outcomes. Payroll administrative controls are the policies, procedures, or guidelines that govern the payroll process. These parts of the risk register may also need to be updated, but they are not as urgent or critical as the risk mitigation plans. Updating the risk factors, process owner, and administrative controls can help identify, assess, and monitor the risk, but they do not directly address the risk response. The risk response is the most important part of the risk management process, as it determines how the risk is handled and controlled.

Modifying logs before analysis compromises the integrity and reliability of monitoring processes. This action creates a risk of inaccurate data feeding into key risk indicators, which undermines the effectiveness of monitoring and decision-making. Maintaining log integrity is a foundational practice inRisk Monitoring and Reporting.