CRISC Exam Dumps - Certified in Risk and Information Systems Control

The organization’s information security manager is responsible for IT security controls that are outsourced to an external service provider. The information security manager is accountable for ensuring that the security policies and standards of the organization are followed by the service provider, and that the security objectives and requirements are met. The information security manager is also responsible for monitoring and evaluating the security performance and compliance of the service provider, and for managing the security risks and incidents that may arise from the outsourcing arrangement. The organization’s risk function, the service provider’s IT management, and the service provider’s information security manager are not responsible for IT security controls that are outsourced, as they have different roles and responsibilities in the outsourcing process. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.2.1.2, page 2461

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 651.

The correct answer isDbecause thesystem ownershould own and drive mitigation of noncompliant platforms. The issue described is a platform noncompliance problem affecting processing and failing to meet approved standards. Ownership of the affected system includes accountability for ensuring that systems meet required security, operational, and performance standards, and for driving corrective action when deficiencies are identified.

The other options are less appropriate:

A. Configuration managermay support configuration control, but does not own the platform risk.

B. Change managercoordinates changes, but is not accountable for the system’s compliance posture.

C. Release managermanages deployments and releases, but does not own ongoing platform compliance and mitigation.

Exact Extracts supporting the answer:

“During the accreditation process the primary role of the system owner is to select and document the security controls for the system.”

“For an IT system supporting a critical business process senior managers should be accountable for the risk.”

“To ensure that identified risk remains at an acceptable level the BEST approach is reviewing controls periodically according to the risk treatment plan.”

“The PRIMARY reason an external risk assessment team reviews documentation as the first step in the risk assessment is to gain a thorough understanding of the enterprise’s business processes.”

“The BEST way to ensure appropriate mitigation occurs on identified information systems vulnerabilities is by assigning action plans with deadlines to responsible personnel.”

These extracts support that accountability for system-level controls and remediation belongs with the owner of the affected system. Therefore, the person who should own and drive mitigation of noncompliant platforms is thesystem owner.

According to the CRISC Review Manual, one of the key objectives of risk identification is to assess the potential impact of risk events on the achievement of business objectives2. In this case, the business objective of the system is to process insurance claim payments for customers, which depends on the accuracy of claim calculation. Therefore, the impact to the accuracy ofclaim calculation should be the most important consideration for a risk-based review of the user requirements. The other options are less relevant or less critical for the business objective.

The principle of least privilege is a key concept in information security that aims to provide users with the minimum level of access—or permissions—necessary to perform their job functions. Byensuring that users only have the access they need, organizations can significantly reduce the risk associated with excessive access by authorized users.

Understanding Least Privilege

The principle of least privilege restricts access rights for users to the bare minimum permissions they need to perform their work. This minimizes the potential damage from accidents or malicious activities.

Least privilege should be applied to all user accounts, including administrative and service accounts.

Implementation

Implementing least privilege involves a detailed analysis of job functions and the necessary access required for each role.

Regularly review and update access permissions to ensure they remain aligned with current job responsibilities and organizational needs.

Mitigating Risk

By limiting access to only what is necessary, organizations can prevent users from having permissions that could be exploited, intentionally or unintentionally, to cause harm.

This also includes revoking unnecessary privileges when users change roles or no longer need access.

Comparison with Other Options

A. Monitoring user activity using security logs: While monitoring can detect inappropriate activity, it does not prevent it.

B. Revoking access for users changing roles: This is a necessary practice but does not address the initial allocation of excessive privileges.

D. Conducting periodic reviews of authorizations granted: Periodic reviews are important but are reactive rather than proactive.

References

Sybex-CISSP-Official-Study-Guide-9-Edition.pdf, p. 641, discussing the principle of least privilege and its implementation​​.

The correct answer is D . Without architecture documentation, the organization may not know all systems, interfaces, dependencies, trust boundaries, data flows, or exposed components. This creates unknown vulnerabilities and weakens risk assessment. The uploaded CRISC notes state that understanding the system and its subsystems is the most effective method to conduct a risk assessment on an internal system. They also state that analysts use organizational structure, policies, standards, technology architecture, and controls criteria to analyze risk scenarios.

Legacy systems, scalability issues, and network isolation problems may exist, but the greatest risk from missing architecture documentation is not knowing where the vulnerabilities are.

===========

According to the CRISC Review Manual, the primary purpose of periodically reviewing an organization’s risk profile is to enable risk-based decision making, because it helps to ensure thatthe risk information is current, relevant, and accurate. The risk profile is a snapshot of the organization’s risk exposure at a given point in time, based on the risk identification, analysis, and evaluation processes. Periodically reviewing the risk profile allows the organization tomonitor the changes in the risk environment, the effectiveness of the risk responses, and the impact of the risk events. This enables the organization to make informed decisions about the risk management strategies and priorities. The other options are not the primary purpose of periodically reviewing the risk profile, as they are related to other aspects of the risk management process. Aligning business objectives with risk appetite is the purpose of establishing the risk context, which defines the scope and boundaries of the risk management activities. Designing and implementing risk response action plans is the purpose of the risk response process, which involves selecting and executing the appropriate risk responses. Updating risk responses in the risk register is the outcome of the risk monitoring and reporting process, which involves tracking the risk performance and communicating the risk information to the stakeholders. References = CRISC Review Manual, 7th Edition, Chapter 2, Section 2.2.4, page 86.

The correct answer is C because continuous monitoring is intended to detect changes in the risk and control environment quickly enough for management to respond. The uploaded CRISC notes state that “the most significant benefit of implementing a continuous risk management process” is that it captures changes to the enterprise risk profile, and that a main purpose of continuous monitoring is detecting changes to the enterprise’s risk environment.

A, B, and D may be secondary benefits, but they are not the greatest benefit. Benchmarking, investment support, and stakeholder identification do not provide the same direct risk-management value as timely detection of emerging risk.

===========

The primary reason for periodically monitoring key risk indicators (KRIs) is to detect changes in the risk profile of the enterprise. KRIs are metrics that provide information on the level of exposure to a specific risk or a group of risks. By monitoring KRIs, the enterprise can identifyany deviations from the expected risk level, and take appropriate actions to adjust the risk response or the risk appetite. Monitoring KRIs also helps to validate the effectiveness of risk mitigation controls and the accuracy of risk assessments. Rectifying errors in results of KRIs, reducing costs of risk mitigation controls, and continually improving risk assessments are possible benefits of monitoring KRIs, but they are not the primary reason. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.1.1.2, page 175.