CRISC Exam Prep Study Guide | 100 Questions with 100% Correct Answers | Updated & Verified

What is the difference between a standard and a policy? - ANS - Standard = A mandatory action, explicit rules, controls or configuration settings that are designed to support and conform to a policy. A standard should make a policy more meaningful and effective by including accepted specifications for hardware, software or behavior. Standards should always point to the policy to which they relate. Policy = IT policies help organizations to properly articulate the organization's desired behavior, mitigate risk and contribute to achieving the organization's goals. What are the 4 risk elements? - ANS - Threats, Vulnerabilities, Likelihood, and Impact. Threats exploit vulnerabilities and the level of risk is based on likelihood and the impact to the system. Describe risk appetite vs. risk tollerance - ANS - Risk appetite is how much risk an organization is willing to endure; Risk Tolerance is how much variation from that amount is acceptable. Name the 6 steps of the NIST Risk Management Framework (RMF) - ANS - 1. Categorize Information Systems 2. Select Security Controls 3. Implement Security Controls 4. Assess Security Controls 5. Authorize Information Systems 6. Monitor Security Controls Which framework is developed by ISACA and integrates other frameworks? a) (Val) IT b) IT Assurance Framework (ITAF) c) COBIT 5 d) Risk IT - ANS - c. COBIT 5