Certified in Risk and Information Systems Control CRISC (CRISC) — Questions 601–675

Establishing a confidential incident reporting system with a no-blame policy directly addresses the root cause — fear of blame — by removing the deterrent to reporting. This creates psychological safety, which is a prerequisite for a healthy risk-aware culture where employees surface issues early.

Classification and ownership assignment come first because every downstream activity, including quantification, treatment selection, transfer, and governance reporting, depends on knowing what each risk is, who owns it, and how it maps to business processes. Establishing a consistent taxonomy and accountable owner creates the structure required for aggregation and defensible risk acceptance at the enterprise level.

Threat modeling workshops with stakeholders are the most effective method because they leverage diverse expertise to systematically identify threats specific to the cloud-based CRM architecture, including misconfigurations in IAM roles, API vulnerabilities, and data residency issues. This collaborative approach aligns with the CRISC focus on proactive risk identification by considering business context, technical constraints, and regulatory requirements early in the lifecycle.

IEC 62443 is the international standard series specifically designed for industrial automation and control systems (IACS) security. It provides a framework for securing IACS across the entire lifecycle, including risk assessment, system design, and operational security, with roles defined for asset owners, system integrators, and product suppliers. It is the de facto standard for OT/ICS security.

A repeat control failure invalidates prior residual risk assumptions, so the correct response is to record the failure, re-rate inherent and residual risk, and launch a dated remediation plan. Closing the finding, maximizing the rating without analysis, or overwriting the record all distort the risk picture and remove the accountability that drives correction.

Storing encryption keys in plaintext on the same server as the encrypted data defeats the purpose of encryption, as an attacker who gains access to the server can easily decrypt the data. The most appropriate risk response is to mitigate by encrypting the key file itself, typically using a key-encryption key (KEK) or a hardware security module (HSM), which protects the keys even if the server is compromised. This directly addresses the vulnerability without removing the data or transferring the risk.

Residual risk is the exposure that remains once existing controls are applied and their effectiveness is factored in. Because the loyalty application's controls reduce the high inherent risk to a level inside the stated appetite, the residual rating is what the organization actually carries. It drives the decision to accept, mitigate further, transfer, or avoid the risk.

Expected loss magnitude is captured as business impact expressed in financial terms, answering how much the organization would lose if the ransomware event disrupted claims processing. Likelihood, inherent risk, and control effectiveness are distinct components that feed into risk analysis but do not themselves quantify the consequence. Documenting financial impact enables meaningful comparison against risk appetite and supports prioritization of treatment options.

The insurer needs to know which systems support which business processes before deciding on treatment, and that dependency mapping is the core purpose of the IDENTIFY function's Asset Management category. Governance sets direction, PROTECT enforces controls, and DETECT finds events, but none of those produces the asset-to-process inventory that leadership explicitly requested.

The most likely root cause is that the risk response workflow was not triggered automatically. In a mature risk monitoring environment, KRIs should be linked to automated workflows that initiate a response when thresholds are breached. Since the KRI has been above threshold for three consecutive months without any action, it indicates a failure in the automated triggering mechanism, not in the KRI's accuracy or the threshold's leniency.

Walkthroughs and testing provide direct, empirical evidence that controls are functioning as designed. For a critical application, this approach validates actual control execution (e.g., verifying that an automated access control list (ACL) on a database server actually blocks unauthorized queries), rather than relying on secondhand accounts or static documentation. Testing confirms operational effectiveness in real-time, which is essential for accurate risk assessment.

Data classification and data sovereignty are concerns about how data is categorized, where it resides, and which legal/regulatory jurisdictions govern it — all of which are addressed in the data architecture layer. This layer defines data models, ownership, retention, classification schemes, and cross-border data flow rules. Risk related to sovereignty (e.g., GDPR data residency) is fundamentally a data architecture design issue.

A risk heat map is a visual tool that plots risks on a grid using likelihood (probability) on one axis and impact (consequence) on the other, typically with color coding (green/yellow/red) to indicate severity. Its primary purpose is to give decision-makers an at-a-glance view of which risks fall into high, medium, or low severity zones. This visual representation supports prioritization and communication, but the visualization itself — not the ranking — is the defining purpose.

Control implementation involves design, procurement/build, testing, deployment, and monitoring.

A threat is an actor or event with the potential to cause harm, while a vulnerability is a weakness that a threat can exploit. The ransomware group targeting healthcare providers is an external threat source with demonstrated intent and capability. Unpatched components, predictable tokens, and missing assessments are internal weaknesses or control gaps that a threat could exploit, not threats themselves.

When residual risk exceeds appetite, the risk owner must choose from the recognized response set: mitigate, transfer, avoid, or accept with proper authority. Applying compensating controls reduces the exposure, and transferring part of the financial consequence through insurance addresses what remains. Accepting without authority, recalculating assumptions to change the rating, and deleting the risk from the register are not legitimate responses because they alter the record rather than the risk.

In the ISACA risk scenario template, the 'Actor' element specifically identifies the entity that initiates or perpetrates the attack. For a ransomware attack, the actor could be an external hacker, a malicious insider, or a cybercriminal group, making option C the correct choice.

The NIST Cybersecurity Framework's Identify function includes categories such as Asset Management, Business Environment, Governance, Risk Assessment, and Risk Management Strategy. Risk assessment is explicitly a key component of Identify because understanding organizational risk is foundational to prioritizing cybersecurity activities. It is listed under ID.RA in the framework core.

VAST (Visual, Agile, and Simple Threat modeling) is the only methodology explicitly designed for agile and DevSecOps environments, integrating threat modeling into CI/CD pipelines and scaling across large development teams. It uses two model types — application threat models for developers and operational threat models for infrastructure — making it suitable for continuous delivery. This agile-native design is why VAST is the best fit when threat modeling must occur early and iteratively in the SDLC.

The most likely explanation for the gap between CSA self-reported effectiveness (80%) and audit-observed failure (30%) is that CSA participants assess controls subjectively and may overestimate effectiveness due to familiarity, optimism, or lack of objectivity, whereas internal audit tests controls using independent, evidence-based procedures. This perception bias is a well-documented limitation of self-assessment. The other options introduce speculative factors (timing, training, scope) that are not supported by the scenario.

ISACA's guidance emphasizes that even minor security incidents without data loss indicate potential control weaknesses that require reassessment. A formal reassessment (A) ensures the vendor's security controls and contractual protections are re-evaluated to address underlying risks, aligning with the principle of continuous risk monitoring and response.

The most effective way to reduce data leakage from lost or stolen BYOD devices is to enforce encryption and enable remote wipe through MDM. This ensures that even if the device is compromised, the data remains protected or can be erased. Other controls are helpful but do not provide the same direct technical mitigation.

A KRI must be a measurable, leading indicator that provides early warning of an emerging risk. A spike in unauthorized remote access attempts is a direct precursor to ransomware intrusion (which typically begins with credential abuse or RDP exploitation), so monitoring this metric can trigger early detection before encryption occurs. It is behavioral, actionable, and tied to the attack chain.

High employee turnover in IT is a risk indicator because it can lead to loss of institutional knowledge, inconsistent security practices, and increased likelihood of misconfigurations or unpatched systems. When experienced staff leave, remaining or new employees may lack the context to properly manage firewall rules, access controls, or incident response, creating vulnerabilities.

Consistent risk monitoring and reporting requires a standardized definition and calculation methodology for each KRI across all business units. Without this common baseline, the aggregated risk data in the ERM system will be incomparable and unreliable, leading to flawed decision-making. Establishing common definitions ensures that the same risk type (e.g., cybersecurity) is measured uniformly, enabling accurate trend analysis and risk aggregation.

A web application firewall (WAF) is the appropriate compensating control because it can inspect and block SQL injection payloads at the HTTP/HTTPS layer without modifying the application code. This provides immediate risk reduction while the development team works on the permanent fix, aligning with the principle of defense-in-depth and the risk manager's responsibility to treat unacceptable risk during the remediation window.

Risk appetite is the amount of risk an organization is willing to accept in pursuit of value, while risk tolerance translates that appetite into measurable, monitorable limits. Expressing the board's statement as maximum acceptable exposure counts for payment data and separate downtime limits for internal reporting systems makes the appetite operational. The other choices are response or assessment activities that do not establish the quantitative boundaries the board's differentiated statement requires.

The reduction from high to medium indicates that controls are partially effective in reducing risk, but not completely.

Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

External threats originate outside the organization and involve actors or events that can affect its assets. Organized criminal credential stuffing and hacktivist website defacement both fit because they are externally initiated and target the bank's online presence or customer accounts. Internal errors, developer mistakes, and provider outages are important risks but do not meet the external threat actor criterion for this analysis.

The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Cost-benefit analysis ensures that the resources invested in controls are justified by the reduction in risk, which is a core principle of risk management. Without this analysis, an organization might over-invest in low-impact risks or under-invest in high-impact ones, leading to inefficient allocation of budget and effort.

Updating system documentation and user manuals is essential during change management because it ensures that the new access control system is accurately reflected in operational procedures, training materials, and compliance artifacts. Without updated documentation, users and auditors operate on stale information, leading to misconfigurations and audit findings. Documentation is a key change management deliverable that supports knowledge transfer and ongoing control effectiveness.

Consistent risk metrics across the organization (Option B) are a key component of an effective risk reporting framework because they ensure that risk data is comparable and aggregated meaningfully across different business units and systems. Without standardized metrics, reports would be inconsistent, making it impossible to assess overall risk posture or identify trends reliably.

Model bias leading to unfair lending practices is the most likely risk to cause regulatory penalties because credit scoring is heavily regulated under fair lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act. If an AI/ML model uses demographic data and produces disparate impact on protected classes, regulators can impose fines, sanctions, and enforcement actions. Unlike data privacy or model drift, bias directly violates anti-discrimination statutes, making it a legal compliance issue with immediate regulatory consequences.

The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.

Immutable backups are the most effective control because they cannot be altered or deleted for a set period, ensuring a clean recovery point even if ransomware compromises the network. Other controls like network access controls, encryption, or backup frequency do not prevent backups from being encrypted or deleted by ransomware.

The committee chose a risk transfer response by buying insurance, which addresses only the financial consequence of a ransomware loss. Because backups and recovery capabilities were left unchanged, the operational and regulatory impacts remained fully exposed, and the four-day restoration breached reporting deadlines. Effective risk response selection must consider whether the chosen treatment addresses the specific impact categories the organization cares about, not just the monetary loss.

The current on-premise appliance (10 Gbps capacity) is insufficient against modern DDoS attacks that can exceed 100 Gbps, as noted in industry reports. Migrating to a cloud-based DDoS protection service that scales to 200 Gbps directly reduces the risk to a level aligned with the company's moderate risk appetite for availability, despite the 40% cost increase. The business concern about cost is secondary to the necessity of mitigating a risk that could cause catastrophic revenue loss, and the cloud service provides elastic scalability that an on-premise upgrade cannot match.

The risk assessment team should first recommend implementing encryption in transit because the current controls only address data at rest, leaving data vulnerable during transmission. Since both inherent and residual risks are high, the most direct and effective control to reduce likelihood is to apply a technical safeguard like TLS 1.3 for data in transit, which directly addresses the identified gap.

Correlation rules between different monitoring tools (Option A) are critical because they define how alerts from disparate sources (e.g., SIEM, IDS/IPS, endpoint detection) are combined to identify complex attack patterns. Without well-tuned correlation rules, the organization may miss multi-stage attacks that span multiple systems, as no single tool alone provides the full picture. Evaluating and refining these rules directly improves the detection of incidents that existing controls failed to catch.

The core issue is a mismatch between the business-required recovery time objective and what the current DR strategy can deliver. The risk practitioner must first document and escalate this gap so the business owner can make an informed risk decision. Directly purchasing technology or rewriting the objective without approval would circumvent governance.

The correct principle is that IT risk is a subset of enterprise risk and material IT risks belong in enterprise reporting. This ensures business leadership sees how technology exposures affect objectives and can allocate resources and set tolerance accordingly. IT still performs the technical analysis, but the results flow upward so governance and strategy reflect the full risk landscape rather than a fragmented view.

Policy development starts with gap analysis, drafting, stakeholder review, approval, and communication.

Replication lag exceeding threshold and unacknowledged critical alerts are leading indicators that measure current degradation of resilience and response capability, giving the risk committee time to intervene before patients are affected. Downtime minutes, long-term MTBF, and raw change volume describe past events or activity levels without predictive value for imminent EHR availability risk, so they do not serve as early-warning KRIs.

The root cause of conflicting KRI reports is that each business unit defines and calculates KRIs differently, uses different thresholds, and reports on different schedules. This lack of standardization leads to inconsistent risk measurements, even when using the same underlying data source. The best remediation is to standardize KRI definitions, calculation methods, thresholds, and reporting frequencies across all business units to ensure consistent and comparable risk reporting to the board.

A leading Key Risk Indicator (KRI) predicts future risk events by measuring conditions that precede incidents. Missing critical patches on systems directly indicate a higher likelihood of exploitation, making it a leading indicator. In contrast, lagging KRIs like incident counts or costs measure outcomes after the fact.

A no-blame incident reporting policy removes the fear of punishment for reporting mistakes, which is the single most effective cultural lever for increasing incident disclosure. Research (e.g., from aviation safety and DevOps postmortems) shows that psychological safety drives reporting rates, and reporting is the prerequisite for detecting and responding to incidents. This directly addresses the 'without fear' requirement in the question.

Tokenization and real-time fraud detection are both mitigation controls because they actively reduce the risk of payment fraud. Tokenization minimizes the value of stolen data, while fraud detection identifies and blocks suspicious transactions. The other options represent risk transfer, risk avoidance, and risk acceptance, which do not reduce the inherent risk.

A two-week outage of critical financial systems directly halts business processes, which is the definition of operational disruption — the inability to execute normal business operations. While financial loss and reputational damage may follow, the primary and most direct business impact category for an outage that stops systems from functioning is operational disruption. CRISC expects the practitioner to map the scenario's immediate effect to the correct impact category.

Mandatory training and quarterly phishing simulations are proactive controls that reduce the likelihood and impact of data loss from human error. This directly aligns with risk mitigation, which seeks to lower residual risk to an acceptable level without eliminating the activity or transferring the financial burden. The controls target the root cause (untrained staff) by improving security awareness and testing behavioral response.

Defining a risk universe by category gives the practitioner a structured way to surface risks from every function, apply consistent terminology, and roll results up for governance. It prevents blind spots and supports ownership and reporting. The alternatives either mistake categories for the register itself, assume unrealistic exclusivity, or skip the underlying assessments that make aggregation meaningful.

Connecting ICS/OT systems to the corporate IT network exposes previously isolated OT devices to the corporate attack surface, allowing threats that compromise IT to pivot into OT. This expansion of the attack surface is the primary risk of IT/OT convergence because OT systems often lack security controls and cannot be easily patched. The other options are secondary or not risks at all.

Residual risk above tolerance that cannot be remediated promptly requires formal acceptance by the governing body. The committee should present the timeline, the vendor dependency, and any compensating controls so the board can make an informed decision. Concealing the timeline, relabeling the risk, or delaying the report all deprive the board of information it needs and violate reporting integrity.

Dual-sourcing is a risk mitigation technique that reduces the likelihood of supply chain disruption by providing an alternative source. It does not transfer, avoid, or accept the risk; it actively reduces it. The primary benefit is increased resilience and reduced dependency on a single supplier.

In FAIR, Loss Magnitude (LM) is the sum of Primary Loss (direct costs) and Secondary Loss (indirect costs) resulting from a loss event.

The primary purpose of a risk and control monitoring program is to provide ongoing assurance that controls are operating effectively. This is achieved through continuous or periodic testing, observation, and analysis of control activities to confirm they are designed correctly and functioning as intended to mitigate risks. Without this ongoing assurance, an organization cannot reliably know whether its risk responses remain effective over time.

The primary risk an Architecture Review Board should consider is the exposure of sensitive customer data through unauthenticated APIs, because this represents a direct, high-impact security and compliance risk (data breach, regulatory penalties, reputational damage). ARBs focus on risks that threaten confidentiality, integrity, and availability of critical assets, and unauthenticated API access to sensitive data is a classic OWASP API Security Top 10 issue.

When a risk has very low likelihood and low impact, the cost of implementing controls (mitigation, transfer, or avoidance) typically exceeds the potential loss. Accepting the risk is the most cost-effective response, as it acknowledges the residual risk without active treatment. This aligns with the principle that risk acceptance is appropriate for risks below the organization's risk appetite threshold.

Cyber insurance premiums are most significantly influenced by the organization's security controls and incident history, because insurers underwrite based on the likelihood and severity of a claim. Strong controls (MFA, EDR, backups, segmentation) and a clean incident history reduce perceived risk and lower premiums; poor controls and prior breaches raise them.