easyMultiple Choice
First Step After Risk Identification — Document and Assess
A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?
Quick Answer
The answer is to document the vulnerability and assess the associated risk in the risk register. This is correct because the CRISC framework mandates that risk identification must be followed immediately by risk assessment; without formally documenting and evaluating the vulnerability’s likelihood and impact, you cannot make an informed, risk-based decision on remediation. On the Certified in Risk and Information Systems Control exam, this tests your understanding that technical controls like patching are secondary to the risk management process—a common trap is jumping to “implement compensating controls” before the risk is formally assessed. The first step after risk identification is always to capture the finding in the risk register and perform a qualitative or quantitative analysis to determine whether the residual risk is acceptable. Memory tip: “Register before Remediate”—always log and assess the risk before choosing a response.
⚠ Common exam trap
The trap here is that candidates often jump to a technical control (like applying a virtual patch or isolating the application) because it seems immediate and effective, but the CRISC exam consistently tests that risk assessment and documentation must come first before any control implementation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the vulnerability and assess the associated risk in the risk register
The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the vulnerability and assess the associated risk in the risk register
Why this is correct
Documenting the vulnerability and assessing its risk in the risk register satisfies the immediate need to evaluate likelihood and impact against existing controls, given the constraint that patching is impossible. This establishes a traceable risk record, enabling prioritised treatment decisions such as compensating controls, rather than premature remediation or acceptance.
- ✗
Apply a virtual patch via an intrusion prevention system
Why it's wrong here
A virtual patch via an intrusion prevention system mitigates exploit traffic, but it does not address the underlying vulnerability, and the stem asks for the first step, which is assessing and documenting the risk. Virtual patching is the right choice when compensating controls must shield an unpatchable system during a defined remediation window.
- ✗
Isolate the application from the network
Why it's wrong here
Isolation is a containment control, not a risk-assessment step; it presumes the vulnerability's business impact and exploitability are already understood. It is tempting because network segmentation genuinely reduces exposure, and would be the right action once the risk has been evaluated and treatment authorised. Here, the practitioner must first assess and document the risk before recommending containment.
- ✗
Notify the application owner and request an emergency patch
Why it's wrong here
Notifying the owner and requesting an emergency patch assumes remediation is feasible, yet the stem states the application cannot be patched immediately. Escalating a patch request therefore stalls without reducing exposure. This approach suits routine vulnerability management where owners can remediate within agreed SLAs, not a legacy system requiring compensating controls first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?
hard- A.Implement encryption immediately
- ✓ B.Document the risk and its source
- C.Assign a risk score
- D.Report to senior management
Why B: The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.
Variation 2. During a review of third-party vendor risks, the risk team identifies that a cloud service provider's data center is located in a country with unstable political conditions. What should the risk practitioner do FIRST?
medium- ✓ A.Document the risk and assess its potential impact.
- B.Accept the risk based on the vendor's SLA.
- C.Request the vendor to move data to another region.
- D.Terminate the contract immediately.
Why A: The risk practitioner's first step should be to document the identified risk and assess its potential impact on the organization. This aligns with the CRISC framework's emphasis on risk identification and assessment before any treatment decisions are made. Without a thorough impact assessment, the organization cannot determine whether the risk is acceptable, requires mitigation, or warrants contract termination.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.