mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: A large healthcare organization is implementing a…
A large healthcare organization is implementing a new electronic health record (EHR) system. During the risk identification process, the risk team discovers that the EHR vendor has a history of minor security incidents but has always resolved them quickly. The vendor’s data center is located in a region prone to earthquakes. Additionally, the EHR system will integrate with several legacy systems that have known vulnerabilities. The project sponsor is keen to proceed and believes the vendor is reputable. The risk team needs to ensure all relevant risks are identified and documented. Which of the following should be the PRIORITY for the risk team?
⚠ Common exam trap
The trap here is that candidates may focus on the legacy system vulnerabilities (Option B) because they are a known technical issue, but the question specifically prioritizes the vendor's data center risk, which is a higher-level business continuity concern that could render all other controls irrelevant if the vendor's site goes offline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a detailed assessment of the vendor's business continuity and disaster recovery plans, especially regarding natural disasters.
The vendor's data center is in an earthquake-prone region, and the vendor has a history of minor security incidents. This creates a significant risk of service disruption that could impact patient safety and data availability. Prioritizing a detailed assessment of the vendor's business continuity and disaster recovery (BC/DR) plans ensures that the organization understands the vendor's ability to maintain operations and recover data in a disaster scenario, which is a fundamental risk identification activity before any mitigation or acceptance decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conduct a detailed assessment of the vendor's business continuity and disaster recovery plans, especially regarding natural disasters.
Why this is correct
BCP/DR assessment addresses the earthquake risk directly.
- ✗
Request the vendor to patch the legacy system vulnerabilities before integration.
Why it's wrong here
Vendor may not have control over legacy systems.
- ✗
Focus on contractual indemnification clauses to transfer risk.
Why it's wrong here
Risk transfer is a treatment, not identification.
- ✗
Accept the residual risk after implementing basic controls.
Why it's wrong here
Acceptance without full identification is premature.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.