Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 376–450

Scenario analysis is most appropriate because the risk of data exfiltration by a malicious insider at the cloud provider is a complex, low-frequency, high-impact threat that is difficult to quantify with historical data. This approach allows the risk manager to systematically evaluate specific attack paths (e.g., an insider with database access copying customer records) by focusing on likelihood and impact, which aligns with the qualitative nature of insider threat assessment in a cloud environment.

The effectiveness of a control is ultimately measured by its ability to consistently reduce residual risk to the organization's defined risk appetite. Regular testing provides empirical evidence that the control is operating as intended and achieving the desired risk mitigation outcome, which is the primary goal of risk treatment.

NERC CIP (Critical Infrastructure Protection) standards require utilities to identify and protect Critical Cyber Assets (CCAs) — later evolved into BES Cyber Systems — that support the reliable operation of the Bulk Electric System. Identification, categorization, and implementation of security controls for these assets is a foundational requirement across the CIP standards (CIP-002 through CIP-014).

The audit finding highlights a delay between termination and account disablement, creating a window for unauthorized access. An automated deprovisioning process integrated with the HR system is the most effective preventive control because it removes human latency and ensures accounts are disabled immediately upon termination. Manual tickets and periodic reviews are detective or delayed, and password expiration does not deactivate accounts.

The default deny rule is overridden by the explicit allow rule, making the deny ineffective. Without an automated test to validate that the deny rule is actually enforced, the monitoring gap is that the control is assumed to work but is not verified. This is a classic control monitoring failure where the existence of a policy is confused with its effectiveness.

Continuous monitoring via SIEM rules provides real-time detection of security events, enabling immediate identification and response to threats as they occur. This is the primary benefit over periodic manual testing, which only identifies issues at discrete intervals and cannot catch events that happen between tests.

Relevance to the organization's industry and technology stack is the highest priority because threat intelligence that does not align with the specific attack surface, software versions, and threat actors targeting that industry will generate excessive false positives and irrelevant alerts. For example, a healthcare organization using Epic EHR would prioritize feeds covering healthcare-specific ransomware (e.g., Ryuk) and medical device vulnerabilities over generic indicators, ensuring risk identification is actionable and contextually accurate.

Risk treatment starts with selecting response, planning, approval, implementation, and monitoring.

The IT risk universe is a comprehensive inventory of all plausible IT-related risks an organization faces, organized by category (e.g., infrastructure, applications, data, third parties, people). Its primary purpose is to ensure completeness — that all potential IT risks are considered and documented — so that subsequent risk assessment, prioritization, and treatment are built on a complete foundation. Without completeness, later steps may overlook material risks.

Updating the encryption protocol directly reduces the vulnerability that could lead to data exfiltration, thereby lowering the likelihood or impact of the risk. This is the definition of risk mitigation, where controls are applied to reduce risk to an acceptable level. The action does not transfer, accept, or avoid the risk; it actively addresses the root cause.

Threat modeling is a proactive, structured approach that identifies potential threats by analyzing the CRM's design, data flows, and trust boundaries. Unlike vulnerability scanning or penetration testing, which find existing weaknesses, threat modeling uncovers threats early in the lifecycle, such as SQL injection via customer input fields or privilege escalation in role-based access controls. This aligns with the CRISC focus on risk identification before controls are implemented.

The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.

When a risk manager decides to accept a risk because the cost of controls exceeds the potential loss, the risk treatment option is risk acceptance. This requires formal acknowledgment and sign-off by the risk owner, who is accountable for the risk and must document the decision, typically in a risk register, to ensure governance and auditability.

Implementing an automated real-time monitoring tool that alerts on authorization failures directly addresses the root cause: the detection delay caused by manual weekly log reviews. Unlike manual reviews, automated monitoring provides immediate notification of control failures, enabling rapid response to intermittent software bugs and reducing the window of exposure for unauthorized transactions.

In a qualitative risk assessment, risk rating is determined by combining the likelihood of a threat occurring with the impact of that threat on business objectives. Likelihood (A) and impact (B) are the two fundamental elements used in a risk matrix to assign a qualitative rating such as high, medium, or low. This approach relies on subjective judgment rather than numerical data, making it suitable for scenarios where precise quantification is not feasible.

Threat events are occurrences or actions that can cause harm, such as a malicious insider exfiltrating data or a natural disaster causing an outage. Vulnerabilities like unpatched software, lack of encryption, or inadequate training are conditions that threats may exploit. Distinguishing between threats and vulnerabilities is essential for accurate risk scenarios.

Implementing flood barriers and redundant cooling systems directly reduces the likelihood and impact of a flood event on the data center's physical infrastructure. This is a risk mitigation strategy that proactively addresses the root cause of the risk (flooding) by hardening the facility, which is the most effective treatment for a high-probability, high-impact physical threat.

Annualized loss expectancy is derived by first computing single loss expectancy, which is the impact of $4,000,000 multiplied by the 30% probability of escalation, giving $1,200,000. Multiplying that by the annualized rate of occurrence of two incidents per year produces $2,400,000. This expected annual loss can be weighed directly against the yearly cost of controls such as immutable backups, segmentation, and detection tooling.

Before reducing residual risk based on third-party assurance, the practitioner must confirm that the assurance actually covers the systems, services, and control objectives the organization relies upon. Scope and period alignment determines whether the SOC 2 Type II opinion is relevant evidence. Auditor reputation, audit clause usage, and public breach history may inform judgment but cannot substitute for verifying that the report addresses the specific risk under review.

The correct answer is risk mitigation. By integrating automated security testing into the CI/CD pipeline, the company is implementing a control that reduces the likelihood of vulnerabilities reaching production. This is a proactive mitigation strategy that aligns with CRISC's emphasis on embedding risk management into business processes.

The Protect function in the NIST Cybersecurity Framework (CSF) covers the safeguards that limit or contain the impact of a cybersecurity event — access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is explicitly defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. Detect, Identify, and Recover address different phases of the risk lifecycle.

Root cause analysis (RCA) on the firewall misconfigurations directly investigates why the misconfigurations occurred, uncovering underlying process weaknesses such as inadequate change management, lack of configuration standards, or insufficient training. This addresses the root cause rather than symptoms, which is exactly what the risk manager needs to prevent recurrence across regional offices.

EDM03 — Ensure Risk Optimization is the governance objective that focuses on evaluating, directing, and monitoring risk management to ensure the enterprise's risk appetite and risk tolerance are understood and articulated.

A board-level risk report must include forward-looking information such as emerging risks and trend analysis of key risk indicators (KRIs) over the past quarter. This enables the board to understand not only the current risk posture but also the direction and velocity of risk changes, which is essential for strategic oversight and proactive decision-making.

The risk owner's first responsibility is to ensure the risk assessment is accurate before deciding on a response. Validating the risk rating with additional data (option B) confirms that the high likelihood and moderate impact are correctly assessed, which is a prerequisite for selecting an appropriate treatment. Jumping to implement controls, transfer, or accept the risk without validation could lead to misallocation of resources or inadequate mitigation.

Threat modeling is the structured technique for examining system architecture, trust boundaries, and data flows to identify where threats can act. Tracing data between the mobile client, API gateway, and database is exactly the data-flow analysis that threat modeling performs. The other techniques address control evaluation, automated weakness detection, or business process criticality rather than architectural data movement.

A KCI measures the performance or effectiveness of a control. The number of blocked intrusion attempts is a direct measure of the firewall's preventive effectiveness.

An anonymous incident reporting system encourages employees to report risks, errors, and near-misses without fear of retaliation, which is fundamental to building a risk-aware culture where people feel safe to speak up. It directly promotes transparency and proactive risk identification, key elements of a risk-aware culture.

A complete identification exercise follows the service and data flows rather than the project's technical boundary. For advanced metering infrastructure, that means including internal billing and outage processes, third-party communication providers, field operations, and regulatory dependencies, because risks frequently arise at these interfaces. A technology-only scope, a register-driven scope, or a deferred timeline would all leave material exposures unidentified or identified too late to influence design.

A risk appetite statement is the formal mechanism for expressing how much risk an organization is willing to accept. It translates broad tolerance into specific, measurable limits such as maximum downtime and data loss. This gives the risk practitioner a clear benchmark for evaluating whether a ransomware risk is within or outside acceptable boundaries, enabling consistent risk response decisions.

A root certificate authority compromise is the most significant residual risk because it can invalidate the trust model for all certificates issued under that CA. Unlike internal control gaps or operational issues, this risk is external and can have widespread impact, including forged certificates for the organization's portal. Risk managers must consider third-party dependencies and the potential for cascading effects when evaluating residual risk.

Leading key risk indicators (KRIs) are predictive in nature because they track forward-looking metrics that signal potential future risk events before they occur. Unlike lagging indicators that measure past outcomes, leading KRIs use trend analysis and threshold monitoring to forecast changes in risk exposure, enabling organizations to anticipate and address issues proactively.

A SOC 2 Type II report provides independent assurance over a service organization's controls over a period of time. When a prospective vendor for critical services cannot provide this report, and the organization's risk appetite is defined, the appropriate action is to reject the vendor or require a formal risk acceptance from the risk owner. This ensures that any deviation from the required control evidence is explicitly acknowledged and approved, rather than bypassing the requirement.

Software Composition Analysis (SCA) is specifically designed to identify known vulnerabilities in open-source libraries by analyzing dependency manifests (e.g., pom.xml, package.json) and correlating them against vulnerability databases like the National Vulnerability Database (NVD). For a web application built with multiple open-source components, SCA automates the detection of outdated or vulnerable libraries, which is the most effective method for this risk identification scenario.

A direct SSH connection from the internet to the database server bypasses all network segmentation and firewall controls, exposing the database to brute-force attacks, credential theft, and unauthorized remote access. SSH is a management protocol, not an application protocol, and its exposure on the internet creates a direct attack surface on the most sensitive data tier, which is the highest risk to the environment.

An effective risk report must communicate changes in the risk landscape, such as new threats, regulatory shifts, or emerging vulnerabilities, to enable senior management to make informed strategic decisions. This ensures the report remains relevant and actionable, reflecting the dynamic nature of risk.

Qualitative risk assessment relies on subjective judgments, such as the risk owner's belief that strong perimeter defenses make an attack unlikely, despite the analyst's view that impact would be catastrophic. This subjectivity can lead to inconsistent or biased risk ratings. The scenario highlights how personal opinion can skew likelihood estimates, which is a core limitation of qualitative analysis.

The CRM migration involves PII from multiple jurisdictions, making data sovereignty and cross-border data transfer restrictions the most critical risk. Regulations like GDPR (EU) and local data localization laws (e.g., Russia, China) can impose fines or block transfers if data leaves approved regions. This risk directly impacts legal compliance and operational continuity, outweighing technical concerns like isolation or patching.

Because the images would reside in a shared multitenant platform, the risk that matters most is logical separation failure between customers. Confirming enforced tenant isolation with segregated encryption keys directly addresses that failure mode. Audit reports, right-to-audit clauses and internal penetration tests provide valuable assurance and leverage but do not specifically prevent one tenant from accessing another tenant's DICOM data.

A KRI that breaches its threshold for two consecutive quarters signals that the underlying risk profile has deteriorated, yet the register still shows a stale medium rating without treatment. The practitioner should escalate to the accountable risk owner so the risk can be reassessed and a documented treatment decision made. Unilateral rating changes, premature insurance recommendations, and deferred discussion all bypass the owner's accountability and delay necessary action.

Third-party risk is a primary IT risk category because organizations increasingly depend on vendors, cloud providers, and service integrators whose failures, breaches, or non-compliance directly affect the organization's IT risk posture. It belongs in the IT risk universe alongside categories such as cybersecurity, availability, data integrity, and compliance risk. Market, inflation, and interest rate risks are financial/market risks, not IT risk categories.

NERC CIP standards require identification and protection of critical cyber assets, including clear boundaries (electronic security perimeters) to control access.

A continuous monitoring tool only delivers meaningful risk information when its monitoring parameters are directly aligned with key risk indicators (KRIs) and critical controls. Without this alignment, the tool may generate noise or miss high-severity events, failing to support risk-based decision-making.

VAST is designed to integrate with agile and DevOps, providing continuous threat modeling.

Deploying an intrusion prevention system (IPS) is a risk mitigation measure because it actively monitors and blocks malicious traffic targeting the vulnerability, reducing the likelihood of exploitation. Implementing a security patch directly removes the vulnerability, thereby reducing both the likelihood and impact of a potential attack. Both actions modify the risk by applying technical controls to lower the residual risk level.

Interviewing the business unit head is the most direct and effective technique to understand the full extent of the risk. The risk manager needs to know the specific business processes, the types and volume of PII stored, the purpose of the application, and how data flows into and out of the SaaS application. Automated tools or logs can only provide technical evidence of usage, but they cannot capture the business context, data classification, or the actual data handling practices that define the risk's scope.

Applying a web application firewall reduces the likelihood and impact of SQL injection against the legacy payment gateway, which is the definition of risk mitigation. The organization continues to operate the asset and retains the residual risk, so avoidance, transfer, and acceptance do not describe the action. Correct classification matters because the risk register and reporting must reflect the true response strategy and its effect on residual risk.

When an organization stops a business activity that creates high-risk exposure, it is applying the risk avoidance treatment option. This is a deliberate decision to eliminate the risk entirely by discontinuing the associated process, system, or operation, rather than attempting to reduce or transfer the residual risk. In IT risk management, avoidance is often chosen when the cost or impact of mitigation exceeds the benefit of the activity, or when the risk level is intolerable under any control scenario.

Separate risk entries preserve the distinct threat, vulnerability, and impact characteristics of each scenario affecting the database server. This granularity enables accurate likelihood and impact ratings, targeted control selection, and clear ownership. Combining unrelated scenarios into one entry would obscure which threat drives which consequence and would make it difficult to measure whether a specific control reduced the risk it was meant to address.

In CRISC, risk prioritization is fundamentally driven by alignment with strategic business objectives because IT risk management exists to protect the enterprise’s mission and goals. Even a high-likelihood or high-financial-impact risk may be deprioritized if it does not materially affect the organization’s strategic objectives, as the risk treatment decision must support business value and continuity. This weighting ensures that resources are allocated to risks that most threaten the enterprise’s ability to achieve its core mission.

The exhibit shows a database server with customer data accessible via a web application that uses unencrypted HTTP (port 80) and has direct internet exposure. This configuration allows an attacker to intercept traffic or exploit the lack of encryption to read sensitive customer data in transit, making unauthorized disclosure the primary risk. The core reasoning is that unencrypted HTTP exposes data to eavesdropping and man-in-the-middle attacks, directly violating confidentiality requirements for sensitive customer information.

When a third party processes PHI, the hospital must ensure the business associate agreement clearly assigns responsibility for breach notification and regulatory penalties. This contractual protection is the most critical risk treatment because it directly addresses the hospital's legal and financial exposure under HIPAA. Other concerns like subcontractors, uptime, and data residency are important but secondary to the allocation of liability.

Risk and control monitoring reports must be tailored to the audience's level of understanding to ensure that stakeholders can effectively interpret the information. For example, an executive summary should focus on high-level risk exposure and strategic impacts, while detailed reports for control owners may include operational metrics. This practice aligns with the principle of communicating risk information in a manner that supports informed decision-making.

When a critical asset cannot be patched or replaced, compensating controls are the correct mitigation approach. Network segmentation limits lateral movement, and host-based IPS can detect and block exploitation attempts on the unsupported system. These measures reduce likelihood without requiring downtime, unlike acceptance, avoidance, or pure risk transfer, which do not address the technical vulnerability in this operational context.

IT risk should be treated as a component of broader operational risk to ensure alignment with enterprise-level risk appetite and reporting.

Cloud object storage exposure almost always stems from permissive bucket policies or ACLs. Denying public access and applying least-privilege identity policies prevents unauthorized reads at the point of access, directly protecting confidentiality. Encryption, versioning, and logging are useful complementary controls but do not by themselves stop a misconfiguration from granting access.

Effective risk identification starts with establishing context: the assets involved, the data flows, the dependencies, and the regulatory environment. Inventorying the telehealth platform's components, protected health information movement, and HIPAA obligations gives the practitioner the basis to enumerate threats and vulnerabilities. Only after this scope is defined do activities such as vendor assurance review, penetration testing, and insurance decisions become targeted and defensible.

Purchasing cyber insurance transfers the financial consequences of a data breach to an insurer in exchange for premiums, which is the definition of risk transfer. The organization retains some residual risk (deductibles, uncovered losses, reputational damage), but the primary treatment mechanism is transfer. This is distinct from mitigation, which reduces likelihood or impact through controls.

Even though the SLA is technically met, the emerging pattern of minor incidents is a leading indicator of rising operational risk, so the risk manager should request a root cause analysis and tighten monitoring, escalating to the board only if the trend worsens. This balances contractual reality (SLA not breached) with proactive risk management (trend detection). It also gives the board meaningful, evidence-based information rather than alarmist or premature action.

COBIT 2019's governance objectives are organized under the EDM (Evaluate, Direct, Monitor) domain. EDM03 — Ensure Risk Optimization is the specific governance objective that ensures enterprise risk is identified, assessed, and managed within the entity's risk appetite, and that risk management activities are optimized. It is the governance-level counterpart to the management-level APO12 (Manage Risk) objective.

A SOC 2 report (or equivalent, such as an ISO 27001 certification or a SIG assessment) provides independent assurance over a vendor's controls, including security monitoring and assessment cadence. Since the vendor is tiered as 'medium risk' and has not performed a security assessment in two years, the risk practitioner should request current evidence of control effectiveness rather than accept, ignore, or escalate the risk prematurely. This aligns with the CRISC principle of verifying control status before making risk response decisions.

In the FAIR (Factor Analysis of Information Risk) ontology, Loss Event Frequency (LEF) is composed of Threat Event Frequency (TEF) and Vulnerability (the probability that a threat event becomes a loss event). Threat Event Frequency is therefore a direct component of LEF. Annualized Loss Expectancy, Primary Loss, and Secondary Loss belong to the loss magnitude side of the model, not LEF.