CRISC Exam Dumps - Certified in Risk and Information Systems Control

According to the CRISC Review Manual (Digital Version), a vulnerability is a flaw or weakness in an asset’s design, implementation, or operation and management that could be exploited by a threat. A delayed removal of employee access is a vulnerability, as it allows former employees to retain access to the organization’s IT assets and processes, which could lead to unauthorized disclosure, modification, or destruction of data or resources. A delayed removal of employee access could be caused by poor personnel management, lack of security awareness, or inadequate access control policies and procedures.

References = CRISC Review Manual (Digital Version), Chapter 1: IT Risk Identification, Section 1.5: IT Risk Identification Methods and Techniques, pp. 32-331

A risk register is the primary tool for communicating progress: it consolidates risk scenarios, mitigation plans, current status, and residual risk in a structured format. Senior management relies on it to make informed decisions.

A RACI matrix clearly defines roles and responsibilities, making it the primary reference for identifying accountability. This aligns withRisk Governance Practicesfor clarifying ownership.

Data protection is the process of safeguarding sensitive personal information from unauthorized access, use, disclosure, modification, or destruction. Data protection can help to ensure the privacy and security ofthe data subjects, and to comply with the legal and regulatory requirements that apply to the data processing activities1.

A highly regulated organization that acquired a medical technology startup company that processes sensitive personal information with weak data protection controls faces a high risk of data breaches, fines, lawsuits, reputational damage, or loss of customer trust. The best way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startupcompany is to classify and protect the data according to the parent company’s internal standards, because it can help to:

Identify and categorize the sensitive personal information based on its value, sensitivity, and criticality, such as confidential, restricted, internal, or public

Apply and enforce the appropriate data protection policies, procedures, and controls for each data category, such as encryption, access control, backup, retention, or disposal

Align and integrate the data protection practices and processes of the startup company with those of the parent company, and ensure the consistency and compliance across the organization

Balance and optimize the trade-off between data protection and data usability, and allow the startup company to leverage the data for innovation and growth, as long as it meets the data protection standards of the parent company23

The other options are not the best ways for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company, but rather some of the steps or aspects of data protection. Identify previous data breaches using the startup company’s audit reports is a step that can help to assess the current data protection status and gaps of the startup company, and to learn from the past incidents and mistakes, but it does not address the future data protection needs and challenges of the startup company. Have the data privacy officer review the startup company’s data protection policies is an aspect that can help to ensure the legal and regulatory compliance of the data protection activities of the startup company, and to provide guidance and oversight for the data protection issues and risks, but it does not ensure the technical and operational effectiveness and efficiency of the data protection controls of the startup company. Implement a firewall and isolate the environment from the parent company’s network is a control that can help to prevent or limit the external or internal attacks or threats to the data of the startup company, and to reduce the exposure or impact of a data breach, but it does not ensure the availability or accessibility of the data for the legitimate and authorized purposes of the startup company. References =

Data Protection - ISACA

Data Classification - ISACA

Data Protection Best Practices - ISACA

[CRISC Review Manual, 7th Edition]

Brainstorming sessions would best contribute to identifying obscure risk scenarios, as they allow participants to generate and share ideas without being constrained by conventional thinking or assumptions. Brainstorming sessions can help to identify risks that are not obvious, not well understood, or not covered by existing controls. Control self-assessments, vulnerability analysis, and Monte Carlo analysis are useful methods for evaluating and quantifying risks, but they are not designed to identify obscure risk scenarios. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 59.

The best way to prevent technical vulnerabilities from being exploited is to update the software with the latest patches and updates. Patches and updates are software modifications that fix the known bugs, errors, or flaws in the software. They also improve the performance, functionality, and security of the software. By updating the software with the latest patches and updates, the company can reduce the exposure and likelihood of the technical vulnerabilities, and protect the software from potential attacks or exploits. The other options are not as effective as updating the software with the latest patches and updates, as they are related to the quality assurance, legal protection, or error handling of the software, not the prevention or mitigation of the technical vulnerabilities. References = Risk and Information Systems Control Study Manual, Chapter 3: IT Risk Response, Section 3.3: IT Risk Response Implementation, page 145.

A retention policy is a set of rules and guidelines that define how long and under what conditions the information should be kept or disposed of by the organization, based on its value, sensitivity, and legal or regulatory requirements.

When information is no longer required to support business objectives, the first thing that should be done is to assess the information against the retention policy. This means that the information should be reviewed and evaluated to determine if it should be retained or deleted, and for how long and by whom.

Assessing the information against the retention policy helps to ensure that the information is managed and disposed of in a consistent and compliant manner, that the information is protected from unauthorized access, use, disclosure, modification, or destruction, and that the information is available for future reference or audit purposes if needed.

The other options are not the first things that should be done when information is no longer required to support business objectives. They are either secondary or not essential for information management.

The references for this answer are:

Risk IT Framework, page 28

Information Technology & Security, page 22

Risk Scenarios Starter Pack, page 20

 The most important step when developing risk scenarios using a list of generic scenarios based on industry best practices is to validate the generic risk scenarios for relevance. The generic risk scenarios may not be applicable or suitable for the specific context, objectives, and environment of the organization. Therefore, the risk practitioner should validate the relevance of the generic risk scenarios by comparing them with the organization’s risk profile, risk appetite, and risk criteria. Assessing generic risk scenarios with business users, selecting the maximum possible risk scenarios from the list, and identifying common threats causing generic risk scenarios are other steps that may be useful, but they are not as important as validating the relevance of the generic risk scenarios. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.