CRISC - Certified In Risk And Information Systems
Control: Q’s And A’s
What is Availability? Right Ans - Providing timely and reliable access to
information
What is the order of Information Security Risk Management Process steps?
Right Ans - 1) Context Establishment
2) Risk Identification
3) Risk Analysis
4) Risk Evaluation
5) Risk Treatment
What does the Risk Identification Process involve? Right Ans - 1) Identify
Assets
2) Identify Threats
3) Identify Existing Controls
4) Identify Vulnerabilities
5) Identify Consequences
6) Risk Estimation
What are examples of Threats? Right Ans - personnel, natural events, theft,
terrorism, criminal acts, software errors, mechanical failure, accidents
The IT risk action plan is an output communication from? Right Ans - Chief
Risk Officer and the Enterprise Risk Management Committee
What is risk Magnitude? Right Ans - The impact to the enterprise when the
event occurs
What are synonyms for Frequency and Magnitude? Right Ans - Likelihood
and Impact
What is Risk Appetite? Right Ans - The amount of risk, on a broad level,
that an entity is willing tot accept in pursuit of its mission
,What is Risk Tolerance? Right Ans - The acceptable level of variation that
management is willing to allow for any particular risk as it pursues its
objectives
What does Risk Governance address? Right Ans - Oversight of the business
risk strategy for the enterprise
What are the 3 objectives of Risk Governance? Right Ans - 1) Establish a
common risk view
2) Integrate risk management into the enterprise
3) Make risk-aware business decisions
What are the 5 components of Governance? Right Ans - 1) Alignment
2) Value Delivery
3) Risk Management
4) Performance Measurement
5) Resource Management
What is the difference between Responsibility and Accountability? Right
Ans - Responsibility belong to those who must ensure that activities are
completed successfully
VS
Accountability which applies to those who either own the required resource
or those who have the authority to approve the execution and/or accept the
outcome of an activity
What is another term for IT Risk Scenario Analysis? Right Ans - Stress Test
What is the rough allocation of risk relevant to almost all organizations?
Right Ans - Financial Risk (35%)
Strategic Risk (25%)
Operational Risk (25%)
Legal and Compliance Risk (15%)
What are the Four CRISC domains?
,(which also represent the cyclic process of IT Risk Management) Right Ans
- 1) IT Risk Identification
2) IT Risk Assessment
3) Risk Response and Mitigation
4) Risk and Control Monitoring and Reporting
What is a Risk? Right Ans - When a threat exploits a vulnerability which
damages an asset which breaks a business process
How do you classify assets? Right Ans - Using an Information/Data
Classification Policy
Which line of defense is a CRISC? Right Ans - 2nd line
Which line of defense is a CIO? Right Ans - 1st line
Which level of Management accepts a risk? Right Ans - Executive
management (i.e. CEO)
What is Control Risk? Right Ans - When the controls chosen to mitigate risk
are incorrect
What is the #1 Project Risk? Right Ans - Failure to meet expectations
What are the 4 ways to deal with a risk? Right Ans - 1) avoid
2) mitigate
3) accept
4) transfer
Is IT Risk part of Op Risk? Right Ans - Yes
What is the framework that SOX controls are based on? Right Ans - COSO
2013
What are the 6 types of controls? Right Ans - 1) Policy
2) Standard
3) Procedure
4) Process
5) Org structure
, 6) Physical entity (e.g. security guard)
(80% of controls are Procedures / Processes)
Anyone who manages risk should not report to..... Right Ans - Someone
who delivers value
What is the best example of a Directive control? Right Ans - A policy
What is a Corrective control? Right Ans - A control for correcting after
detection occurs (e.g. incident response)
How do you apply Governance? Right Ans - Oversight committees
What is residual risk? Right Ans - The remaining risk after management
has implemented risk response / controls.
What is the risk formula? Right Ans - Risk = Likelihood (of threat exploiting
a vulnerability) X Impact
(R = L x I)
What is the primary purpose of the certification and accreditation process?
Right Ans - The goal is to deliver a system that meets the agreed-on set of
security requirements and the operational conditions that were set for its
implementation to ensure that it will be operated in a secure manner.
The purpose of certification is to have an impartial third party review the
security plans and risk assessments associated with the system and provide
an objective recommendation to the business owner on whether he/she
should approve the operation of the system.
What is the Control Effectiveness formula? Right Ans - Control
Effectiveness = Design Effectiveness X Operational Effectiveness
What is Lost Causal Analysis (LCA) Right Ans - Loss Causal Analysis (to
create a database of likelihood from past events)
Control: Q’s And A’s
What is Availability? Right Ans - Providing timely and reliable access to
information
What is the order of Information Security Risk Management Process steps?
Right Ans - 1) Context Establishment
2) Risk Identification
3) Risk Analysis
4) Risk Evaluation
5) Risk Treatment
What does the Risk Identification Process involve? Right Ans - 1) Identify
Assets
2) Identify Threats
3) Identify Existing Controls
4) Identify Vulnerabilities
5) Identify Consequences
6) Risk Estimation
What are examples of Threats? Right Ans - personnel, natural events, theft,
terrorism, criminal acts, software errors, mechanical failure, accidents
The IT risk action plan is an output communication from? Right Ans - Chief
Risk Officer and the Enterprise Risk Management Committee
What is risk Magnitude? Right Ans - The impact to the enterprise when the
event occurs
What are synonyms for Frequency and Magnitude? Right Ans - Likelihood
and Impact
What is Risk Appetite? Right Ans - The amount of risk, on a broad level,
that an entity is willing tot accept in pursuit of its mission
,What is Risk Tolerance? Right Ans - The acceptable level of variation that
management is willing to allow for any particular risk as it pursues its
objectives
What does Risk Governance address? Right Ans - Oversight of the business
risk strategy for the enterprise
What are the 3 objectives of Risk Governance? Right Ans - 1) Establish a
common risk view
2) Integrate risk management into the enterprise
3) Make risk-aware business decisions
What are the 5 components of Governance? Right Ans - 1) Alignment
2) Value Delivery
3) Risk Management
4) Performance Measurement
5) Resource Management
What is the difference between Responsibility and Accountability? Right
Ans - Responsibility belong to those who must ensure that activities are
completed successfully
VS
Accountability which applies to those who either own the required resource
or those who have the authority to approve the execution and/or accept the
outcome of an activity
What is another term for IT Risk Scenario Analysis? Right Ans - Stress Test
What is the rough allocation of risk relevant to almost all organizations?
Right Ans - Financial Risk (35%)
Strategic Risk (25%)
Operational Risk (25%)
Legal and Compliance Risk (15%)
What are the Four CRISC domains?
,(which also represent the cyclic process of IT Risk Management) Right Ans
- 1) IT Risk Identification
2) IT Risk Assessment
3) Risk Response and Mitigation
4) Risk and Control Monitoring and Reporting
What is a Risk? Right Ans - When a threat exploits a vulnerability which
damages an asset which breaks a business process
How do you classify assets? Right Ans - Using an Information/Data
Classification Policy
Which line of defense is a CRISC? Right Ans - 2nd line
Which line of defense is a CIO? Right Ans - 1st line
Which level of Management accepts a risk? Right Ans - Executive
management (i.e. CEO)
What is Control Risk? Right Ans - When the controls chosen to mitigate risk
are incorrect
What is the #1 Project Risk? Right Ans - Failure to meet expectations
What are the 4 ways to deal with a risk? Right Ans - 1) avoid
2) mitigate
3) accept
4) transfer
Is IT Risk part of Op Risk? Right Ans - Yes
What is the framework that SOX controls are based on? Right Ans - COSO
2013
What are the 6 types of controls? Right Ans - 1) Policy
2) Standard
3) Procedure
4) Process
5) Org structure
, 6) Physical entity (e.g. security guard)
(80% of controls are Procedures / Processes)
Anyone who manages risk should not report to..... Right Ans - Someone
who delivers value
What is the best example of a Directive control? Right Ans - A policy
What is a Corrective control? Right Ans - A control for correcting after
detection occurs (e.g. incident response)
How do you apply Governance? Right Ans - Oversight committees
What is residual risk? Right Ans - The remaining risk after management
has implemented risk response / controls.
What is the risk formula? Right Ans - Risk = Likelihood (of threat exploiting
a vulnerability) X Impact
(R = L x I)
What is the primary purpose of the certification and accreditation process?
Right Ans - The goal is to deliver a system that meets the agreed-on set of
security requirements and the operational conditions that were set for its
implementation to ensure that it will be operated in a secure manner.
The purpose of certification is to have an impartial third party review the
security plans and risk assessments associated with the system and provide
an objective recommendation to the business owner on whether he/she
should approve the operation of the system.
What is the Control Effectiveness formula? Right Ans - Control
Effectiveness = Design Effectiveness X Operational Effectiveness
What is Lost Causal Analysis (LCA) Right Ans - Loss Causal Analysis (to
create a database of likelihood from past events)
