You are performing a qualitative risk assessment. Which factor must be prioritized to ensure the assessment is aligned with the organizational risk appetite?
You are integrating an enterprise risk register with a GRC tool (e.g., Archer). Which method provides the most accurate view of 'Residual Risk' to the board?
A risk assessment reveals that a legacy system stores PII without encryption. The business cannot replace it. What is the most appropriate risk management action?
A healthcare insurer's risk register lists a data center flood as a risk with an Annualized Loss Expectancy (ALE) of $200,000. The Chief Risk Officer decides to purchase an insurance policy with an annual premium of $50,000 and a $100,000 deductible. What is the residual risk, expressed as an expected annual loss, assuming the insurer retains the deductible portion of any loss?
Your organization adopts the NIST CSF 2.0. Which specific function should be assessed to identify gaps in your enterprise risk management program's Governance component?
A financial services firm is expanding its risk management program to include cyber risk quantification. The CISO wants to express cyber risk in monetary terms to compare it with other business risks. Which approach best aligns with this objective?
A multinational corporation is integrating its risk management program with its enterprise risk management (ERM) framework. The ISSMP is tasked with ensuring that risk appetite and tolerance are effectively communicated and applied across all business units. Which TWO actions are most critical to achieve this integration? (Choose two.)
A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The ISSMP must ensure that the assessment adequately addresses regulatory requirements. Which of the following should be the PRIMARY focus of the risk assessment?
A global financial services firm has completed a quantitative risk analysis for its primary trading platform. The analysis shows an annualized loss expectancy (ALE) of $4.2 million. The platform owner proposes a $1.1 million annual security program that would reduce the ALE to $900,000. The Chief Information Security Officer (CISO) must decide whether to recommend funding. The organization's risk appetite statement permits a maximum residual ALE of $1.5 million for critical systems. Which decision is most appropriate?
A healthcare organization is integrating risk management into its enterprise architecture practice. The Chief Risk Officer (CRO) wants to ensure that new technology initiatives are evaluated for risk before funding is approved. Which activity best demonstrates that risk management is embedded in the architecture governance process?
A global financial services firm is expanding its enterprise risk management (ERM) program to include third-party risk. The CISO wants to ensure that the risk appetite for third-party relationships is consistently applied across all business units. Which of the following is the MOST effective way to achieve this?
A healthcare organization is conducting a risk assessment for a new telehealth platform that will store protected health information (PHI). The risk team has identified that the platform's encryption at rest uses a deprecated algorithm. The vendor cannot upgrade the algorithm for another six months due to contractual constraints. Which of the following is the BEST risk response?
A multinational corporation is integrating its risk management program with its supply chain management. The CISO wants to ensure that risk assessments are performed consistently for all suppliers. Which of the following is the MOST important factor to consider when defining the risk assessment criteria?
A financial services firm uses a risk matrix with likelihood and impact scales. During a risk assessment, the team identifies a new vulnerability in a core banking application. The likelihood is rated as 'Possible' (3 on a 1-5 scale) and the impact as 'Major' (4 on a 1-5 scale). The organization's risk appetite statement says that risks with a score of 12 or higher require immediate treatment. What is the risk score and what action should be taken?
A security manager is presenting a risk register to the executive committee. One risk item shows a high likelihood and high impact, but the risk owner has proposed a treatment plan that requires significant funding. The executive committee asks for justification. Which of the following is the BEST approach to justify the investment?
A multinational corporation is implementing an Enterprise Risk Management (ERM) program. The Chief Risk Officer wants to ensure that risk management is integrated into strategic planning. Which of the following activities best demonstrates this integration?
A security manager is developing a risk treatment plan for a critical vulnerability in a web application. The vulnerability allows remote code execution and has a high likelihood of exploitation. The organization has a low risk appetite. Which TWO of the following are the MOST appropriate risk treatment options to consider? (Choose two.)
A global retailer is expanding its risk management program to include third-party vendors. The Chief Information Security Officer (CISO) is concerned about supply chain risks. Which TWO of the following are the most effective controls to mitigate third-party risk? (Choose two.)
A software development company is integrating risk management into its DevOps pipeline. The security team wants to implement a control that automatically scans code for vulnerabilities before deployment. Which of the following best describes this type of control in the context of risk management?