easyMultiple ChoiceObjective-mapped
First Step After Risk Identification — Document and Assess
A vulnerability scan of the internal network reveals a critical vulnerability in a legacy application that cannot be patched immediately. What is the FIRST step the risk practitioner should take?
Quick Answer
The answer is to document the vulnerability and assess the associated risk in the risk register. This is correct because the CRISC framework mandates that risk identification must be followed immediately by risk assessment; without formally documenting and evaluating the vulnerability’s likelihood and impact, you cannot make an informed, risk-based decision on remediation. On the Certified in Risk and Information Systems Control exam, this tests your understanding that technical controls like patching are secondary to the risk management process—a common trap is jumping to “implement compensating controls” before the risk is formally assessed. The first step after risk identification is always to capture the finding in the risk register and perform a qualitative or quantitative analysis to determine whether the residual risk is acceptable. Memory tip: “Register before Remediate”—always log and assess the risk before choosing a response.
⚠ Common exam trap
The trap here is that candidates often jump to a technical control (like applying a virtual patch or isolating the application) because it seems immediate and effective, but the CRISC exam consistently tests that risk assessment and documentation must come first before any control implementation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the vulnerability and assess the associated risk in the risk register
The first step is to document the vulnerability and assess the associated risk in the risk register because risk identification and assessment must precede any remediation decision. Without a formal risk assessment, the practitioner cannot determine whether compensating controls (like a virtual patch or isolation) are appropriate or whether the residual risk is acceptable to the business. This aligns with the CRISC framework's emphasis on risk-based decision-making before implementing technical controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the vulnerability and assess the associated risk in the risk register
Why this is correct
Proper risk identification and documentation precede treatment decisions.
- ✗
Apply a virtual patch via an intrusion prevention system
Why it's wrong here
This is a temporary technical control but should follow risk documentation.
- ✗
Isolate the application from the network
Why it's wrong here
Isolation is a compensating control that should be based on documented risk decisions.
- ✗
Notify the application owner and request an emergency patch
Why it's wrong here
Patch may not be available; risk documentation is needed first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a risk identification workshop, the team identifies a potential data leakage from a legacy system. What is the FIRST step the risk owner should take?
hard- A.Implement encryption immediately
- ✓ B.Document the risk and its source
- C.Assign a risk score
- D.Report to senior management
Why B: The first step for the risk owner is to formally document the risk and its source. This ensures that the identified data leakage from the legacy system is captured in the risk register, establishing a baseline for analysis and treatment. Without documentation, subsequent steps like risk scoring, control implementation, or escalation cannot be properly justified or tracked.
Variation 2. During a review of third-party vendor risks, the risk team identifies that a cloud service provider's data center is located in a country with unstable political conditions. What should the risk practitioner do FIRST?
medium- ✓ A.Document the risk and assess its potential impact.
- B.Accept the risk based on the vendor's SLA.
- C.Request the vendor to move data to another region.
- D.Terminate the contract immediately.
Why A: The risk practitioner's first step should be to document the identified risk and assess its potential impact on the organization. This aligns with the CRISC framework's emphasis on risk identification and assessment before any treatment decisions are made. Without a thorough impact assessment, the organization cannot determine whether the risk is acceptable, requires mitigation, or warrants contract termination.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.