CCNA Cism Risk Management Questions

Conducting due diligence before contracting is essential to identify risks and ensure the vendor meets security requirements. Vulnerability scans are part of due diligence but not the most critical step. NDA and liability clauses are important but secondary to initial assessment.

Qualitative risk assessment uses ordinal rating scales (e.g., 1-5 or Low-Medium-High) to estimate likelihood and impact based on expert judgment, not precise numerical values. This approach is standard in frameworks like ISO 27005 and NIST SP 800-30, which define qualitative analysis as relying on subjective categorization rather than hard financial data.

Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

ISO 31000 defines risk transfer (sharing) as a valid risk treatment option, where the risk is shifted to another party, such as through insurance or outsourcing. This is a standard approach in information security risk management to reduce the financial impact of a risk event.

A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Correct matches: A-BCP, B-DRP, C-BIA. Common confusions: MTD is about downtime, RPO is about data loss.

Integrating information security risk into ERM ensures that security risks are considered alongside business risks, enabling better prioritization and resource allocation. This alignment helps the organization make informed decisions that balance risk appetite and business objectives. The primary driver is to support strategic decision-making, not just compliance or reporting.

When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

The correct matches are: Symmetric Encryption uses a shared key, Asymmetric Encryption uses a key pair, and Hash Function produces a one-way digest. Distractors confuse the purpose of digital signatures and the nature of PKI.

A risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Risk avoidance is a valid risk treatment option per ISO 31000, where the organization decides to eliminate the risk by not engaging in or discontinuing the activity that gives rise to the risk. For example, in information security, this could mean choosing not to deploy a vulnerable legacy system or terminating a high-risk third-party integration. It directly reduces exposure to zero for that specific risk scenario.

Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

KRIs should be leading indicators that predict risk changes. The number of third-party vendors with critical security findings is a direct measure of third-party risk and can indicate a rising risk trend before an incident occurs.

The control reduces the annualized loss expectancy (ALE) from $500,000 to a much lower value (since likelihood drops from high to low). The annual cost of the control is $100,000, which is significantly less than the $500,000 expected loss without it. Implementing the control provides a positive return on investment (ROI) and is the most cost-effective risk mitigation strategy.

ISO 31000's risk evaluation phase requires aligning treatment decisions with the organization's risk appetite. With a moderate risk appetite, a low-likelihood but very-high-impact risk cannot simply be accepted (as it exceeds appetite), nor is avoidance necessary since the likelihood is low. Mitigation through controls that reduce the impact is the most balanced approach, bringing the residual risk within the moderate appetite threshold.