CRISC Risk Response and Reporting — 10 Questions

Question 1

An IT risk manager is preparing a quarterly risk report for the CISO. Which type of reporting structure does this represent?

Accepted Answer

Tactical risk reporting. Tactical risk reporting sits between operational (day-to-day) and strategic (long-term, board-level) reporting. A quarterly report to the CISO summarizing risk posture, treatment progress, and emerging issues is a tactical artifact — it supports medium-term decision-making by security leadership. This is the standard CRISC classification.

Answer

Executive risk reporting

Answer

Operational risk reporting

Answer

Strategic risk reporting

Question 2

A vendor is classified as 'critical' based on its access to sensitive data and the criticality of its service. According to best practices, what minimum security requirement should be mandated for this vendor?

Accepted Answer

SOC 2 Type II report. A SOC 2 Type II report is the minimum security requirement for a critical vendor because it provides independent attestation that controls operated effectively over a period (typically 6-12 months), covering security, availability, and confidentiality. For vendors with sensitive data access, Type II evidence of sustained control operation is essential.

Answer

Annual self-assessment questionnaire

Answer

Penetration test results from the vendor

Answer

ISO 27001 certificate

Question 3

Which risk reporting frequency is most appropriate for tactical risk reporting to the CISO/CIO?

Accepted Answer

Quarterly. Tactical risk reporting to senior executives like the CISO/CIO is typically done quarterly, aligning with governance cycles and providing enough time to aggregate meaningful trends without overwhelming leadership with operational detail. Quarterly reporting supports strategic oversight while monthly or weekly cadence is reserved for operational or management-level reporting.

Answer

Weekly

Answer

Monthly

Answer

Annually

Question 4

An organization is designing a vendor risk management program. Which TWO of the following are essential components of ongoing vendor monitoring? (Select TWO)

Accepted Answer

Continuous monitoring via shared threat intelligence platforms. Option D is correct because continuous monitoring through shared threat intelligence platforms enables real-time visibility into a vendor's security posture, allowing the organization to detect emerging vulnerabilities, breaches, or changes in the vendor's risk profile as they occur rather than waiting for periodic reviews. Option E is correct because annual reassessment of vendor risk ensures that the vendor's security controls, financial stability, and compliance status are re-evaluated on a recurring basis, which is a core requirement of ongoing monitoring programs such as those aligned with ISO 27001, NIST SP 800-161, or SOC 2 vendor management criteria. Option A is not an ongoing monitoring activity; contract terms are reviewed during procurement, renewal, or legal review cycles, not as part of continuous or periodic risk monitoring. Option B is incorrect because penetration testing performed by the vendor is a point-in-time assurance activity, not a monitoring component, and it does not provide the organization with ongoing visibility into the vendor's risk. Option C is incorrect because an initial onboarding security questionnaire is a one-time due diligence step performed before or at the start of the relationship, not an ongoing monitoring activity.

Answer

Review of contract terms

Answer

Penetration testing by the vendor

Answer

Initial onboarding security questionnaire

Question 5

Which THREE of the following are common elements of a periodic control effectiveness testing program? (Select THREE)

Accepted Answer

Quarterly control testing by the risk function. Option B is correct because a periodic control effectiveness testing program typically schedules recurring tests — such as quarterly — performed by the risk or compliance function to verify that controls operate as designed over time. Option D is correct because internal audit independently reviews and tests controls as part of its assurance role, providing objective evaluation of control design and operating effectiveness. Option E is correct because annual penetration testing is a recurring, scheduled assessment that validates the effectiveness of technical and preventive controls against real-world attack techniques. Option A does not belong because user training is a control-awareness or personnel control itself, not a method of testing whether controls are effective. Option C does not belong because continuous monitoring via SIEM is an ongoing detective control and monitoring capability, not a periodic control effectiveness testing activity.

Answer

User training on new controls

Answer

Continuous monitoring via SIEM

Question 6

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). An Intrusion Detection System (IDS) is a classic detective control because it monitors network or host activity and alerts on suspicious or malicious behavior after it occurs. It does not prevent the activity—it detects and reports it, which is the defining characteristic of a detective control.

Answer

Backup and recovery plan

Answer

Firewall

Answer

Data encryption

Question 7

Which of the following is a leading indicator that the risk of a credential-based attack may be increasing?

Accepted Answer

Failed authentication spike. A failed authentication spike is a leading indicator because it directly signals an increase in attempted unauthorized access, often from credential stuffing or brute-force attacks. Unlike lagging indicators that measure past incidents, this metric provides early warning that the risk of a credential-based attack is rising, allowing proactive controls like account lockout policies or CAPTCHA challenges to be implemented before a breach occurs.

Answer

Increased number of successful logins

Answer

Low patch compliance

Answer

High mean time to resolve incidents

Question 8

An organization is implementing a new control to address a high-risk vulnerability. Which TWO factors are MOST important to consider during the control implementation planning phase?

Accepted Answer

Resource requirements. Option C (Resource requirements) is correct because during control implementation planning you must determine the budget, staffing, time, and technology needed to deploy the control effectively; without adequate resources the control cannot be implemented as designed. Option D (Control implementation plan) is correct because a formal plan defines the scope, steps, responsibilities, timeline, and success criteria for rolling out the control, ensuring the high-risk vulnerability is actually mitigated. Vendor reputation (A) is a procurement consideration but not a core planning factor for implementation itself. Industry best practices (B) inform control selection and design rather than the implementation planning phase. The number of previous incidents (E) is a risk-assessment input, not a primary factor in planning how to implement the chosen control.

Answer

Vendor reputation

Answer

Industry best practices

Answer

Number of previous incidents

Question 9

A third-party vendor has been tiered as 'high risk' due to access to sensitive customer data. The vendor's SOC 2 Type II report has a qualified opinion on security controls. The vendor risk appetite requires unqualified SOC 2 Type II for critical vendors. What is the MOST appropriate risk response?

Accepted Answer

Require the vendor to remediate the issues and provide an updated report within a defined timeframe. If a vendor does not meet the minimum security requirements for its tier, and the organization cannot accept the risk, the appropriate response is to remediate by requiring the vendor to address the qualification or find an alternative vendor that meets the requirements.

Answer

Accept the qualified report and continue monitoring

Answer

Implement additional compensating controls on the organization's side

Answer

Downgrade the vendor to medium risk tier

Question 10

Which of the following is a detective control?

Accepted Answer

Intrusion detection system (IDS). Detective controls identify incidents after they occur. An intrusion detection system (IDS) monitors network traffic and alerts on suspicious activity, making it a detective control.

Answer

Firewall

Answer

Backup and recovery procedure

Answer

Data encryption