Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 1–75

The risk register should include a description of the risk event, its impact, and the response. While other details are relevant, the core of the entry is the event and its consequences.

Board-level reporting requires concise, actionable insights. Presenting the top five risks by residual risk level, with a trend indicator (e.g., increasing, stable, decreasing), allows the board to quickly understand the most critical exposures and whether risk posture is improving or deteriorating. This aligns with the CRISC focus on risk communication that supports strategic decision-making, not operational detail.

Risk assessment begins with asset identification, then threats/vulnerabilities, followed by likelihood and impact analysis, risk calculation, and documentation.

The patch lag KRI measures the time between a patch's release and its deployment. An increase from 15 to 45 days means systems are exposed to known vulnerabilities for a longer period, directly increasing the window of opportunity for exploitation. This trend indicates a worsening security posture and higher vulnerability risk.

Compliance risks involve violations of laws, regulations, or contractual obligations. Regulatory fines for data protection non-compliance fall under the compliance category.

The IT risk universe is a comprehensive inventory of all potential IT risks that could affect the organization, serving as the foundation for further risk assessment and treatment.

When the cost of the control ($500k) exceeds the annualized loss expectancy (ALE) of $300k and the risk is within the organization's risk appetite, it is more cost-effective to accept the risk rather than implement a costly control.

The policy configuration shows a rule allowing inbound HTTP/HTTPS traffic from the internet to a web server without any associated encryption requirement (e.g., no TLS enforcement or VPN). This directly exposes the web server to untrusted networks, making it vulnerable to man-in-the-middle attacks and data interception, which is the most significant risk indicated.

Preventive controls aim to stop the risk event from occurring; patching is a classic preventive control.

Change management ensures that changes to systems are controlled, tested, and approved to prevent unintended disruptions or security gaps. It is essential during control implementation.

The reduction from 20 to 8 indicates the controls are effective in reducing risk.

ALE reduction is 80% of $500,000 = $400,000. Net benefit = ALE reduction - annual control cost = $400,000 - $150,000 = $250,000.

Operational IT risks relate to the day-to-day functioning of IT systems and processes. Production line downtime due to a system failure directly impacts operations.

Detective controls identify risk events that have occurred. Intrusion detection systems (IDS) monitor network traffic for malicious activity and alert administrators.

Operational risk reporting is typically provided on a weekly or monthly basis to IT management to support day-to-day decision-making.

A SOC 2 Type II report is the most indicative of a vendor's control effectiveness because it provides an independent auditor's opinion on the design and operating effectiveness of controls over a specified period (typically 6–12 months). For a critical vendor, this third-party attestation offers objective evidence that security and privacy controls are actually working, not just promised.

Brainstorming is a structured group technique that leverages the collective expertise of stakeholders to identify a wide range of IT risks, including emerging threats and vulnerabilities that may not be captured by automated tools. It is effective because it encourages creative thinking and surfaces risks related to business processes, third-party dependencies, and human factors that are often missed by purely technical assessments.

STRIDE is ideal for application threat modeling, and PASTA provides a risk-centric approach for critical applications.

Confidential data is the classification category specifically designed to protect sensitive information that, if disclosed, could cause significant harm to the organization, including intellectual property theft. In a data classification scheme, 'Confidential' typically applies to trade secrets, source code, and proprietary designs, making it the most effective category for identifying and mitigating risks related to IP theft.

Data quality and consistency issues (A) are a common challenge because risk monitoring dashboards aggregate data from multiple sources, each with its own format, timeliness, and accuracy. Inconsistent data leads to unreliable metrics and false alarms, undermining the dashboard's purpose of providing a single source of truth for risk posture.

A control implementation plan should cover all aspects of deployment, including project management, change management, user training, and documentation updates.

The first step in incident response is to validate the alert by reviewing real-time logs and metrics to confirm it is not a false positive, and then assess the potential impact on business operations. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment or escalation. Without verification, subsequent actions like vendor contact or escalation may be premature and waste resources.

A phased approach focusing on high-risk areas (e.g., privileged accounts, sensitive data) optimizes limited resources. Full automation (Option B) is too costly; outsourcing (Option A) may have data privacy issues; accepting the state (Option D) is irresponsible given audit findings.

Security questionnaires are commonly used during initial vendor assessment to gather information about the vendor's security posture.

It describes a specific risk scenario: an employee inadvertently sharing confidential data via email due to lack of data classification training. This is a valid risk scenario as it identifies a threat (human error), a vulnerability (insufficient training), and a potential impact (data leakage). In IT risk identification, scenarios must be concrete and actionable, not just statements of compliance or controls.

The correct response is to implement compensating controls such as strict network access controls and monitoring. Given the low risk appetite for data confidentiality, the 18-month delay for the middleware solution is unacceptable, and the two-year migration timeline leaves a significant exposure window. Compensating controls like VLAN segmentation, ACLs, and continuous traffic monitoring can reduce the likelihood of exploitation of the clear-text transmission without requiring changes to the legacy mainframe itself.

VAST (Visual Agile and Simple Threat) is tailored for Agile and DevSecOps environments, emphasizing simplicity and visual representation.

Strategic risk reporting to the board requires a high-level view that aligns IT risk with enterprise objectives. Option B is correct because it demonstrates how IT risk is integrated into the broader enterprise risk management (ERM) framework, enabling the board to understand the business impact of IT risks. This integration is essential for strategic decision-making, as it connects technical risk data to organizational goals and risk appetite.

Connecting OT networks to IT networks expands the attack surface, allowing threats from the corporate network to reach ICS/SCADA systems, which were previously isolated.

A no-blame incident reporting policy directly addresses the psychological barrier of fear of reprisal, which is the primary reason employees hesitate to report security incidents. By explicitly stating that reporters will not face disciplinary action for unintentional errors or omissions, the organization fosters psychological safety and encourages timely reporting, which is critical for effective risk response.

Qualitative risk analysis using heat maps is quick to perform and easy to communicate to stakeholders, making it the primary advantage. The other options are not primary advantages of this method.

The ISACA risk scenario template includes threat actor, threat event, and asset/resource as essential components. Timing, detection, and response are also included but are not always considered essential for the basic scenario.

Acceptance is the most appropriate response because the vulnerability exists in a legacy application that supports a non-critical business process and is used by a small number of users. The cost and operational impact of patching or replacing the application outweigh the risk, making it acceptable to operate with the known vulnerability under formal risk acceptance.

The primary purpose of risk and control monitoring is to verify that controls are operating as intended. This involves ongoing testing and observation to ensure that control activities are effectively mitigating risks to the desired level. Without this verification, an organization cannot confirm that its risk responses are actually working.

Training should ideally be delivered before go-live to ensure users can operate the system securely. Delaying training increases the risk of errors and security incidents.

Using consistent risk metrics and terminology across IT and enterprise levels ensures that IT risks are communicated in a language that the broader ERM framework understands, enabling aggregation and comparison. This alignment prevents siloed risk assessments and supports a unified view of risk exposure across the organization, which is a foundational requirement for integrating IT risk into ERM.

Correct matches: Quantitative → numerical values/formulas; Qualitative → subjective categories; Semi-quantitative → hybrid numeric/qualitative. Common confusions include swapping these definitions.

When a previously accepted risk materializes due to a change in the external environment, the risk treatment plan is no longer valid. The most appropriate response is to re-evaluate the risk treatment plan (Option D) because the original acceptance decision was based on assumptions that have now changed. This ensures that new controls or alternative treatments are considered to address the realized risk effectively.

Conducting a threat modeling exercise (D) is the most effective approach because it systematically identifies threats, vulnerabilities, and attack vectors specific to the cloud architecture, data flow, and trust boundaries of the migration. Unlike generic reviews, threat modeling (e.g., using STRIDE or PASTA) directly addresses the unique risks of moving a customer database to a public cloud, such as misconfigured access controls, insecure APIs, or data exposure during transit.

Continuous monitoring via shared threat intelligence platforms (Option D) is essential because it provides real-time visibility into emerging threats and vulnerabilities that may affect the vendor's environment. This allows the organization to proactively adjust risk posture without waiting for periodic reviews, aligning with the CRISC principle of ongoing risk response.

The current annual loss expectancy (ALE) is $500,000. An 80% reduction lowers the ALE by $400,000, resulting in a new ALE of $100,000. The annual control cost is $100,000, so the net benefit is the reduction in ALE ($400,000) minus the control cost ($100,000), which equals $300,000.

Enforcing DLP controls directly reduces the likelihood of intellectual property theft by monitoring and blocking unauthorized email exfiltration, which is a classic risk mitigation (reduce) action. Purchasing a cyber liability policy transfers the financial impact of a breach to an insurer, demonstrating risk transfer. Formally accepting the residual risk after controls acknowledges that some risk remains, which is risk acceptance.

A failed authentication spike is a leading indicator because it directly signals an increase in attempted unauthorized access, often from credential stuffing or brute-force attacks. Unlike lagging indicators that measure past incidents, this metric provides early warning that the risk of a credential-based attack is rising, allowing proactive controls like account lockout policies or CAPTCHA challenges to be implemented before a breach occurs.

When the residual risk remains above the risk tolerance but the cost of further mitigation exceeds the potential loss, the most appropriate step is to formally accept the residual risk. This decision is based on a cost-benefit analysis showing that additional controls are not economically justified. The risk owner documents the acceptance, acknowledging the remaining exposure within the organization's risk appetite framework.

Vulnerability scanning is a key risk identification technique that systematically probes IT systems for known vulnerabilities, such as unpatched software or misconfigurations, using tools like Nessus or OpenVAS. It directly identifies weaknesses that could be exploited by threats, making it essential for the risk identification phase.

Deploying full-disk encryption and multi-factor authentication directly reduces the likelihood and/or impact of data breaches from weak encryption on portable devices. This is the definition of risk mitigation — applying controls to lower risk to an acceptable level. The organization is actively reducing the vulnerability, not transferring, accepting, or avoiding the risk.

ISACs (Information Sharing and Analysis Centers) provide sector-specific threat intelligence and can share information about threats targeting cloud infrastructure relevant to the organization's industry.

Data sovereignty (regulatory), shared responsibility model (security gaps), and vendor lock-in (strategic) are key cloud risks that the ARB should assess before implementation.

Control monitoring frequency should be driven by the assessed risk level and the effectiveness of existing controls. High-risk areas or controls with lower effectiveness require more frequent monitoring to ensure timely detection of failures, while low-risk or highly effective controls can be monitored less often, optimizing resource allocation.

Annualized benefit = reduction in ALE - annual control cost. Reduction in ALE = $150k - $30k = $120k. Benefit = $120k - $20k = $100k.

A configuration vulnerability arises from improper system settings. Leaving default passwords unchanged is a classic configuration weakness.

When a KRI exceeds its threshold for multiple consecutive periods, the first action is to investigate the root cause to determine whether the increase indicates a genuine security issue (e.g., brute-force attack, credential stuffing) or a false positive. Jumping to reporting or threshold adjustment without understanding the underlying cause could lead to misallocation of resources or missed detection of an actual threat. This aligns with the CRISC principle that risk indicators must be validated before escalation or remediation.

Tuning the IDS to reduce false positive alerts directly addresses the root cause of alert fatigue: excessive noise from misconfigured or overly sensitive detection rules. By adjusting thresholds, signatures, and exclusion lists, the security team can focus on genuine threats without being overwhelmed, which is a core risk monitoring and reporting practice.

A standardized risk assessment methodology is essential for consistent identification and assessment of risks across the enterprise.

Transferring risk shifts the financial consequences to a third party, such as through outsourcing or insurance.

Vague rating criteria lead to inconsistent and subjective risk scores. By defining clear and objective rating criteria for likelihood and impact, the organization ensures that all assessors apply the same standards, reducing ambiguity and improving the accuracy of the qualitative assessment.

Automated SIEM rules for intrusion detection (B) are a continuous monitoring technique because they operate in real-time, analyzing logs and events as they occur to detect and alert on security incidents without manual intervention. This aligns with the CRISC principle of ongoing, automated oversight rather than periodic or ad-hoc reviews.

Quantum computers capable of breaking RSA-2048 are not imminent but expected within 10-20 years. The most urgent action is to start planning for post-quantum cryptography migration, as it requires long lead times for assessment and implementation.

The risk manager is comparing the cost of implementing the WAF against the likelihood and potential impact of a SQL injection attack. This direct comparison of mitigation cost to risk reduction benefit is the essence of a cost-benefit analysis, which determines whether the control is economically justified. It is not a calculation of residual or inherent risk, nor is it an acceptance decision.

Patch lag is a leading indicator that vulnerability risk is increasing because unpatched systems are more exposed to exploits.

Secondary loss includes indirect costs like reputational damage, loss of customer trust, and share price impact.

The cost of implementing additional controls exceeds the potential financial loss from regulatory fines, making mitigation economically inefficient. Transferring the risk through cyber insurance is the most appropriate option because it shifts the financial impact of the fines to an insurer, aligning with cost-benefit analysis principles in risk management.

SAST (Static Application Security Testing) analyzes source code for vulnerabilities, and DAST (Dynamic Application Security Testing) tests running applications. IAST combines both but is less common. CVE database and CIS Benchmarks are asset- and configuration-focused, not application-specific.

Given the low tolerance for compliance risk, any potential compliance violation (like PII exposure) must be escalated immediately, even if operational risk is moderate.

The first step in responding to a security incident, such as a 300% spike in failed authentication attempts, is to analyze the logs to determine the source and nature of the activity. This aligns with the NIST incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes any containment or reporting action. Without understanding whether the spike is due to a brute-force attack, a misconfigured application, or a credential-stuffing campaign, any subsequent action could be premature or ineffective.

When a risk is within appetite, the appropriate response is to accept it, with formal documentation and sign-off by the risk owner.

The detective control (manual review) is ineffective because the audit sample of 50 transactions is statistically insufficient to detect a failure rate of 100 suspicious transactions out of the total population. The continuous monitoring system provides near-real-time visibility into all transactions, revealing a significant gap that the small sample missed. A control cannot be deemed effective when a larger, more comprehensive monitoring system shows a high volume of unaddressed suspicious activity.

A is correct because data privacy regulations (e.g., GDPR, CCPA, LGPD) have conflicting requirements for data retention, consent, breach notification, and cross-border transfer. Continuous monitoring must reconcile these differences, often requiring jurisdiction-specific rule sets and mapping controls to multiple legal frameworks, which introduces significant complexity and risk of non-compliance.