CRISC Exam Dumps - Certified in Risk and Information Systems Control

A vendor risk assessment is a process of evaluating and managing the risks associated with outsourcing IT services or functions to a third-party provider, such as a cloud service provider.

One of the most important documents to request from a cloud service provider during a vendor risk assessment is an independent audit report. This is a report that provides an objective and reliable assurance on the quality, security, and performance of the cloud service provider’s operations, processes, and controls, based on the standards and criteria established by an independent auditor or a recognized authority, such as ISACA, ISO, NIST, etc.

An independent audit report helps to verify the compliance and effectiveness of the cloud service provider’s risk management practices, identify any gaps or issues that may affect the service delivery or security, and recommend improvements or corrective actions.

The other options are not the most important documents to request from a cloud service provider during a vendor risk assessment. They are either secondary or not essential for vendor risk management.

The references for this answer are:

Risk IT Framework, page 22

Information Technology & Security, page 16

Risk Scenarios Starter Pack, page 14

The second line of defense is a group of functions that provide oversight, guidance, and monitoring of the risk management activities of the first line of defense. The second line of defense includes risk management, compliance, and internal control departments. Their key responsibility is to monitor the effectiveness of the control activities implemented by the first line of defense, and to report any issues or gaps to senior management and the board. The second line of defense also supports the first line of defense by providing frameworks, policies, tools,and techniques to identify, measure, and manage risks. The other options are not the key responsibility of the second line of defense, as explained below:

A. Implementing control activities is the responsibility of the first line of defense, which consists of the business units and process owners that own and manage the risks associated with their daily operations.

C. Conducting control self-assessments is a technique used by the first line of defense to evaluate the design and operation of their own controls, and to identify and report any deficiencies or improvement opportunities.

D. Owning risk scenarios is the responsibility of the first line of defense, which is accountable for the risks inherent in their business activities, and for developing and executing risk response strategies. References = Modernizing The Three Lines of Defense Model | Deloitte US, The second line of defence: fit for purpose, not an uncomfortable fit | Knowledge | Linklaters, COSO’s Take on the Three Lines of Defense | ERM - Enterprise Risk Management, Three Lines of Defense | Risk Management - Schneider Downs CPAs, What is the Three Lines of Defense Approach to Risk Management?

 The PRIMARY purpose of using control metrics is to evaluate the variance against objectives, because control metrics are measures that indicate the performance and effectiveness of the controls in achieving the desired outcomes and goals. Control metrics can help to identify and quantify the gaps or deviations between the actual and expected results of the controls, and to provide feedback and improvement for the control design and implementation. The other options are not the primary purpose, because:

Option A: Amount of risk reduced by compensating controls is a result of using control metrics, but not the primary purpose. Compensating controls are controls that provide an alternative or additional level of protection or assurance when the primary or preferred controls are not feasible or effective. Control metrics can help to measure and monitor the amount of risk reduced by compensating controls, but they are not the only or the most important measure of the control performance and effectiveness.

Option B: Amount of risk present in the organization is an input to using control metrics, but not the primary purpose. The amount of risk present in the organization is the level of exposure and uncertainty that the organization faces in pursuing its objectives and goals. Control metrics can help to assess and report the amount of risk present in the organization, but they are not the only or the most important measure of the risk profile and exposure.

Option D: Number of incidents is a source of using control metrics, but not the primary purpose. Incidents are events or occurrences that disrupt or threaten the normal operations or security of the organization. Control metrics can help to analyze and respond to the number of incidents, but they are not the only or the most important measure of the incident management and resolution. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 120.

 A vulnerability is a system flaw or weakness that can be exploited by a threat actor, potentially leading to a security breach or incident. A vulnerability that has been exploited means that a threat actor has successfully taken advantage of the vulnerability and compromised the system or network. Implementing controls can help reduce the impact of a vulnerability that has been exploited, by limiting or preventing the damage or loss caused by the security breach or incident. Controls are the mechanisms or procedures that ensure the security, reliability, and quality of an IT system or process. Controls can be classified into different types, depending on their purpose and function. The four types of controls mentioned in the question are:

Detective control: A control that monitors and detects the occurrence or attempt of a security breach or incident, and alerts the appropriate personnel or system. For example, a log analysis tool that identifies and reports any unauthorized access or activity on the system or network.

Deterrent control: A control that discourages or prevents a threat actor from exploiting a vulnerability or performing a malicious action, by increasing the perceived difficulty, risk, or cost of doing so. For example, a warning message that informs the user of the legal consequences of unauthorized access or use of the system or network.

Preventive control: A control that blocks or stops a threat actor from exploiting a vulnerability or performing a malicious action, by eliminating or reducing the vulnerability or the opportunity. Forexample, a firewall that filters and blocks any unwanted or malicious traffic from entering or leaving the system or network.

Corrective control: A control that restores or repairs the system or network to its normal or desired state, after a security breach or incident has occurred, by fixing or removing the vulnerability or the impact. For example, a backup and recovery tool that restores the data or functionality of the system or network that has been corrupted or lost due to the security breach or incident.

The best type of control for reducing the impact of a vulnerability that has been exploited is the corrective control, because it directly addresses the damage or loss caused by the security breach or incident, and restores the system or network to its normal or desired state. Corrective controls can help minimize the negative consequences of a security breach or incident, such as downtime, data loss, reputational harm, legal liability, or regulatory sanctions. Corrective controls can also help prevent or reduce the recurrence of the security breach or incident, by fixing or removing the vulnerability that has been exploited. References = Types of Security Controls, Security Controls: What They Are and Why You Need Them, Security Controls: Definition, Types & Examples.

 A risk register is a document that records and tracks the identified risks, their causes, impacts, likelihood, responses, and status. A risk register can help manage and communicate risks throughout the risk management process. A risk register should be updated regularly to reflect the current state of risks and their responses. Due to a change in business processes, an identified risk scenario may no longer require mitigation, as the risk level may have decreased or the risk may have been eliminated. However, the risk should remain in the risk register, as the most important reason is to monitor for potential changes to the risk scenario. This means keeping track of the internal and external factors that may affect the risk scenario, such as new threats, vulnerabilities, opportunities, or controls. Monitoring for potential changes to the risk scenario can help identify and respond to any emerging or reoccurring risks, and ensure that therisk register is accurate and complete. References = Risk and Information Systems Control Study Manual, Chapter 1: IT Risk Identification, Section 1.3: Risk Register, p. 41-43.

Control ownership is the assignment of roles and responsibilities for the design, implementation, monitoring, and improvement of controls that mitigate risks. Control ownership can help ensure that the controls are effective, efficient, and aligned with the business objectives and risk appetite. Control ownership can also help facilitate the communication, coordination, and accountability among the stakeholders involved in the risk management process. One of the factors that would present the greatest challenge when assigning accountability for control ownership is unclear reporting relationships. Reporting relationships are the formal or informal lines of authority and communication that define who reports to whom, and who is accountable for what. Unclear reporting relationships can create confusion, ambiguity, and conflict among the control owners and other stakeholders, such as the risk owners, the business owners, the auditors, the regulators, etc. Unclear reporting relationships can also hinder the performance evaluation, feedback, and recognition of the control owners, and affect their motivation and commitment. Unclear reporting relationships can also increase the risk of duplication, inconsistency, or gaps in the control activities, and compromise the quality and reliability of the control environment. References = Defining, Assigning and Measuring: Accountability Challenges in 21st Century Governance, CRISC 351-400 topic3, Foundations of Project Management : Week 2.

 Residual risk is the risk that remains after security controls have been implemented on a system. Residual risk can be accepted, transferred, avoided, or further mitigated. The most important consideration when deciding whether to accept residual risk is the cost versus benefit of additional mitigating controls. This means comparing the potential impact of the residual risk with the cost and effectiveness of implementing more controls to reduce it. If the cost of additional controls outweighs the benefit of reducing the residual risk, then it may be acceptableto accept the residual risk. However, if the benefit of additional controls exceeds the cost, then it may be advisable to implement more controls to lower the residual risk to an acceptable level. References = Risk and Information Systems Control Study Manual, Chapter 3: Risk Response and Mitigation, Section 3.4: Risk Response Selection, p. 156-157.

According to the CRISC Review Manual1, the contracts department is responsible for drafting, reviewing, and negotiating contracts with vendors and other third parties. The contracts department should ensure that the contracts include adequate clauses and terms to address the risks and controls related to the vendor services and activities. Therefore, the best course of action for the risk practitioner when finding a missing clause to control privileged access to the organization’s systems by vendor employees is to report this concern to the contracts department for further action. The contracts department can then revise the contract to include the necessary clause, or seek alternative solutions to mitigate the risk of unauthorized or inappropriate access by vendor employees. References = CRISC Review Manual1, page 229.