CRISC Exam Dumps - Certified in Risk and Information Systems Control

According to the GDPR, personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes1. This means that a business unit can only use personal information for a different purpose if it has obtained the consent of the data subject, or if it has a clear legal basis or obligation to do so2. Therefore, informed consent should be the first consideration when a business unit wants to use personal information for a purpose other than for which it was originally collected.

References = GDPR Article 5 (1) (b) and Article 6 (4)1, ICO Principle (b): Purpose limitation2

The most significant risk to an organization when updating the incident response plan is the undefined assignment of responsibility. An incident response plan is a document that defines the roles, responsibilities, procedures, and resources for responding to an incident that could disrupt the normal operations of the organization, or compromise its assets, reputation, or compliance. An incident response plan should clearly assign the responsibility for each task and activity involved in the incident response process, such as detection, containment, analysis, eradication, recovery, and reporting. Undefined assignment of responsibility could lead to confusion, duplication, conflict, or omission among the stakeholders, and impair the effectiveness and efficiency of the incident response process. Undefined assignment of responsibility could also increase the risk of escalation, recurrence, or impact of the incident, and affect the accountability and performance of the organization. Obsolete response documentation, increased stakeholder turnover, and failure to audit third-party providers are also risks, but they are not as significant as undefined assignment of responsibility, as they do not directly affect the execution and outcome of the incident response process. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 130.

The control owner is the person who is responsible for designing, implementing, monitoring, and maintaining a control. The control owner is best suited to determine whether a new control properly mitigates data loss risk within a system, as they have the most knowledge and authority over the control. The control owner should also evaluate the effectiveness and efficiency of the control and report any issues or gaps to the risk owner.

The other options are not the best suited to determine whether a new control properly mitigates data loss risk within a system. The data owner is the person who has the accountability and authority over the data and its classification. The data owner may not have the technical expertise or access to evaluate the new control. The risk owner is the person who has the accountability and authority to manage a specific risk. The risk owner may not have the detailed knowledge or involvement in the new control. The system owner is the person who has the accountability and authority over the system and its operation. The system owner may not have the direct responsibility or oversight of the new control. References = CRISC TOPIC 3 EXAM SHORT Flashcards, CRISC-1-50 topic3 Flashcards, CRISC Certified in Risk and Information Systems Control – Question609

The best indicator of the condition of a risk management program is the amount of residual risk. Residual risk is the risk that remains after the implementation of risk responses. Residual risk reflects the effectiveness and efficiency of the risk management program in reducing the risk exposure to an acceptable level, and in aligning the risk profile with the risk appetite and tolerance of the enterprise. A low amount of residual risk indicates that the risk managementprogram is performing well, and that the controls are adequate and appropriate. A high amount of residual risk indicates that the risk management program is not functioning properly, and that the controls are insufficient or ineffective. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.2, page 191

Key risk indicators (KRIs) are metrics or measures that provide information on the current or potential exposure and performance of an organization in relation to specific risks. KRIs can help to monitor and track the changes or trends in the risk level and the risk response over time, identify and alert the risk issues or events that require attention or action, evaluate and report the effectiveness and efficiency of the risk management processes and practices, and support and inform the risk decision making and improvement1.

The best way to enable the identification of trends in risk levels is to ensure that the correlation between risk levels and KRIs is positive, because it means that the KRIs are aligned with and reflective of the risk levels, and that they can capture and indicate the variations or movements in the risk levels accurately and reliably. A positive correlation between risk levels and KRIs can be achieved by:

Selecting and defining the KRIs that are relevant and appropriate for the specific risks that the organization faces, and that are consistent and comparable across different domains and contexts

Collecting and analyzing the data and information that are reliable and sufficient for the KRIs, and that are sourced from various methods and sources, such as risk assessments, audits, monitoring, alerts, or incidents

Applying and using the tools and techniques that are suitable and feasible for the KRIs, such as risk matrices, risk registers, risk indicators, or risk models

Reviewing and updating the KRIs periodically or as needed, and ensuring that they reflect the current or accurate risk levels, which may change over time or due to external factors23

The other options are not the best ways to enable the identification of trends in risk levels, but rather some of the factors or aspects of KRIs. Measurements for KRIs are repeatable is a factor that can enhance the reliability and validity of the KRIs, as it means that the KRIs can produce the same or similar results under the same or similar conditions. However, repeatability does not necessarily imply accuracy or sensitivity, and it may not capture or reflect the changes or trends in the risk levels. Quantitative measurements are used for KRIs is an aspect that can improve the objectivity and precision of the KRIs, as it means that the KRIs are expressed in numerical or measurable values, such as percentages, probabilities, or monetary amounts. However, quantitative measurements may not be suitable or feasible for all types of risks or KRIs, and they may not capture or reflect the complexity or uncertainty of the risk levels. Qualitative definitions for KRIs are used is an aspect that can enhance the understanding and communication of the KRIs, as it means that the KRIs are expressed in descriptive or subjective terms, such as high, medium, or low, based on criteria such as likelihood, impact, or severity. However, qualitative definitions may not be consistent or comparable across different risks or KRIs, and they may not capture or reflect the magnitude or variation of the risk levels. References =

Key Risk Indicators: What They Are and How to Use Them

Key Risk Indicators: A Practical Guide | SafetyCulture

Key Risk Indicators: Types and Examples

[CRISC Review Manual, 7th Edition]

 The greatest risk to change control in business application development over the complete life cycle is the introduction of requirements that have not been approved. Requirements are the specifications or expectations of the business users or stakeholders for the application, such as the features, functions, or performance1. Change control is the process of identifying, evaluating, approving, and implementing changes to the application, such as the design, code, or configuration2. By introducing requirements that have not been approved, the organization can face significant risks, such as:

Scope creep, which is the uncontrolled or unauthorized expansion of the project scope, and can result in increased costs, delays, or errors3.

Quality issues, which can affect the reliability, usability, or security of the application, and can lead to defects, failures, or breaches4.

Stakeholder dissatisfaction, which can arise from the mismatch or inconsistency between the delivered application and the expected application, and can cause complaints, disputes, or litigation5.

The other options are not the greatest risk to change control, because:

Emphasis on multiple application testing cycles is not a risk, but rather a benefit or a best practice for change control, as it can help to ensure that the application meets the requirements and standards, and that the changes are effective and efficient.

Lack of an integrated development environment (IDE) tool is a challenge, but not a risk, for change control, as it can affect the productivity, collaboration, or integration of the developers, and can cause difficulties or inefficiencies in the development process. However, it does not directly affect the requirements or the quality of the application, and it can be overcome by using other tools or methods.

Bypassing quality requirements before go-live is a risk, but not the greatest risk, for change control, as it can compromise the quality or performance of the application, and can expose the organization to errors, failures, or breaches. However, it is less likely or frequent than introducing requirements that have not been approved, and it can be detected or prevented by using quality assurance or quality control techniques.

References =

Requirements - CIO Wiki

Change Control - CIO Wiki

Scope Creep - CIO Wiki

Quality - CIO Wiki

Stakeholder Management - CIO Wiki

[Software Testing - CIO Wiki]

[Integrated Development Environment (IDE) - CIO Wiki]

[Quality Requirements - CIO Wiki]

[Software Development Life Cycle - CIO Wiki]

Authentication logs are records of the attempts and results of logging into an IT system, network, or application, such as the user name, password, date, time, location, or device1. Authentication logs can help to verify and audit the identity and access of the users, and to detect and investigate any unauthorized or suspicious login activities, such as failed or repeated attempts, or unusual patterns or locations2.

Among the four options given, the discovery that authentication logs have been disabled should be of greatest concern to the organization. This is because disabling authentication logs can:

Prevent or hinder the organization from monitoring and controlling the access and activity of the users, especially the disgruntled, terminated IT administrator who may have malicious intentions or insider knowledge

Enable or facilitate the disgruntled, terminated IT administrator or other attackers to bypass or compromise the authentication mechanisms or policies, and gain unauthorized or elevated access to the IT systems, networks, or applications

Conceal or erase the evidence or traces of the login attempts or actions of the disgruntled, terminated IT administrator or other attackers, and make it difficult or impossible to identify, investigate, or prosecute them

Indicate or imply that the disgruntled, terminated IT administrator or other attackers have already breached or compromised the IT systems, networks, or applications, and have disabled the authentication logs to cover their tracks or avoid detection3

References = What is Authentication Logging?, Authentication Logging - Wikipedia, Fired admin cripples former employer’s network using old credentials

A risk management program is a systematic and structured approach to identify, analyze, evaluate, treat, monitor, and communicate the risks that may affect the organization’s objectives and performance.

The greatest advantage of implementing a risk management program is enabling risk-aware decisions. This means that the organization incorporates the risk information and analysis into its decision making process, such as strategic planning, resource allocation, project management, etc.

Enabling risk-aware decisions helps to optimize the outcomes and benefits of the decisions, balance the opportunities and threats of the decisions, and align the decisions with the organization’s risk appetite and tolerance.

The other options are not the greatest advantages of implementing a risk management program. They are either secondary or not essential for risk management.

The references for this answer are:

Risk IT Framework, page 25

Information Technology & Security, page 19

Risk Scenarios Starter Pack, page 17