CRISC Exam Dumps - Certified in Risk and Information Systems Control

Residual system access is the risk that the customer service representatives who are transferred to the sales department may still have access to the systems or applications that they used in their previous role, which may not be relevant or authorized for their new role.

The access control manager is the person or function who is responsible for defining, implementing, and maintaining the policies and procedures for granting, modifying, reviewing, and revoking access rights to the systems or applications, based on the principle of least privilege and the segregation of duties.

The access control manager is responsible for mitigating the risk associated with residual system access, by ensuring that the access rights of the customer service representatives are updated or removed according to their new role and responsibilities, and that the access changes are documented and approved by the appropriate authorities.

The other options are not responsible for mitigating the risk associated with residual system access. They are either irrelevant or less effective than the access control manager.

The references for this answer are:

Risk IT Framework, page 26

Information Technology & Security, page 20

Risk Scenarios Starter Pack, page 18

Implementing a data masking process is the best method to mitigate the risk of an unauthorized employee viewing confidential data in a database. Data masking is the process of replacing sensitive data with fictitious but realistic data, such as changing names, addresses, phone numbers, etc. Data masking protects the privacy and confidentiality of the data, while still allowing for testing, analysis, or training purposes. Implementing role-based access control, including sanctions in NDAs, and installing a DLP tool are also useful methods to reduce the risk of data exposure, but they are not as effective as data masking, which prevents the data from being accessed in the first place. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.1, page 3-21.

Root cause analysis helps identify the fundamental reason for an incident, allowing the enterprise to implement controls that reduce the probability of recurrence.

 Information security policies are the foundation of an organization’s security program, as they define the objectives, roles, responsibilities, and standards for protecting the information assets and systems. However, information security policies are not static, and they need to be reviewed and updated regularly to reflect the changes in the organization’s environment, risk profile, and compliance requirements. Therefore, the best course of action when conducting an organization-wide risk assessment is to review the policies against current needs to determine adequacy. This means comparing the policies with the current threats, vulnerabilities, controls, and best practices, and identifying any gaps or weaknesses that need to be addressed. The other options are not the best course of action, as they do not consider the current needs of the organization. Reviewing and updating the policies to align with industry standards may not be sufficient, as the organization may have specific or unique needs that are not covered by the standards. Determining that the policies should be updated annually may not be realistic, as the frequency of updates may depend on the nature and complexity of the policies and the organization. Reporting that the policies are adequate and do not need to be updated frequently may not be accurate, as the policies may be outdated or ineffective, and may expose the organization to unnecessary risks. References = Risk Assessment and Analysis Methods: Qualitative and Quantitative - ISACA, Does Your Organization Need a Security Risk Assessment? - ISACA, SP 800-39, Managing Information Security Risk: Organization, Mission …

The most important concern when assigning multiple risk owners for an identified risk is that accountability may not be clearly defined. Accountability is the obligation of an individual or group to take responsibility for the risk and its associated actions and outcomes. If multiple risk owners are assigned for the same risk, there may be confusion, conflict, or overlap in their roles and responsibilities, and they may not be held accountable for the risk management performance. Risk ratings being inconsistently applied, different risk taxonomies being used, and mitigation efforts being duplicated are other possible concerns, but they are not as important as accountability not being clearly defined. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 12; CRISC Review Manual, 6th Edition, page 215.

Key risk indicators (KRIs) are metrics that help organizations monitor and evaluate the level of risk they are exposed to. They provide early warning signals of potential issues that could affect the achievement of organizational goals12.

The most important data source for monitoring KRIs is automated logs collected from different systems, which are records that capture and store the details and history of the transactions or activities that are performed by the organization’s processes, systems, or controls34.

Automated logs collected from different systems are the most important data source because they provide timely and accurate data and information on the performance and status of the organization’s operations, and enable the detection and reporting of any deviations, anomalies, or issues that may indicate a risk event34.

Automated logs collected from different systems are also the most important data source because they support the accountability and auditability of the organization’s operations, and facilitate the investigation and resolution of any risk event34.

The other options are not the most important data sources, but rather possible inputs or factors that may influence or affect the KRIs. For example:

Directives from legal and regulatory authorities are documents that provide the expectations and obligations of the external authorities or bodies that govern or oversee the organization’s activities and operations, such as laws, regulations, standards, or contracts5 . However, these documents are not the most important data source becausethey do not directly measure or monitor the level of risk exposure, but rather provide the criteria or framework for risk compliance5 .

Audit reports from internal information systems audits are documents that provide the findings and recommendations of the independent and objective assessment of the adequacy and effectiveness of the organization’s information systems, processes, and controls . However, these documents are not the most important data source because they do not directly measure or monitor the level of risk exposure, but rather provide the assurance or improvement for risk management .

Trend analysis of external risk factors is a technique that involves analyzing and forecasting the changes and impacts of the external factors that influence the organization’s operations, such as technology, competition, regulation, or customer behavior . However, this technique is not themost important data source because it does not directly measure or monitor the level of risk exposure, but rather provide the insight or prediction for risk identification . References =

1: Key Risk Indicators: A Practical Guide | SafetyCulture1

2: Key risk indicator - Wikipedia2

3: Database Activity Monitoring - Wikipedia3

4: Database Activity Monitoring (DAM) | Imperva4

5: Regulatory Compliance - Wikipedia5

Regulatory Compliance Management Software | MetricStream

IT Audit and Assurance Standards, ISACA, 2014

IT Audit and Assurance Guidelines, ISACA, 2014

Trend Analysis - Investopedia

Trend Analysis: A Definition and Examples

Regular reviewshelp detect inappropriate, outdated, or excessive access rights. This is a fundamental part of access control governance and supports the principle of least privilege.

The number of emergency change requests is the most important factor to review when confirming whether implemented controls are operating effectively, as it indicates the frequency and severity of incidents or issues that require urgent changes to the controls, and may reflect the control deficiencies or failures. The results of benchmarking studies, the results of risk assessments, and the maturity model are not the most important factors, as they are more related to the comparison, evaluation, or improvement of the controls, respectively, rather than the confirmation of the control effectiveness. References = CRISC Review Manual, 7th Edition, page 154.