Select Two (Multi-Select) Questions

Periodic manual testing of a sample of transactions for compliance with approval policy.

Direct testing verifies control operation.

Automated alerts when a system control fails to execute.

Direct monitoring of control performance.

Implementing firewalls to protect the network perimeter.

Correct: Firewalls reduce the likelihood of network-based attacks, which is a mitigation technique.

Conducting regular vulnerability assessments and patching.

Correct: Vulnerability assessments and patching reduce the likelihood or impact of exploits, which is mitigation.

Regulatory requirements governing the project's outcomes.

Strict regulations increase the consequence of non-compliance, raising inherent risk.

Complexity of the project's technology stack.

Greater complexity typically increases the probability of vulnerabilities, raising inherent risk.

Extent of external network connectivity.

More connectivity increases the attack surface, elevating inherent risk.

Timeliness of the information provided.

Timely information allows management to act promptly.

Consistency in definitions and metrics over time.

Consistency enables trend analysis and comparability.

Tailoring the report to the target audience.

Different stakeholders need different levels of detail.

Ease of exploitation

Easier exploitation increases likelihood.

Existing controls

Controls reduce likelihood.

Threat actor capability

Capability affects the chance of exploitation.

Log monitoring and analysis

Log monitoring detects events after the fact.

Intrusion detection system (IDS)

IDS detects potential intrusions after they occur.

The criticality of the control to risk mitigation.

Critical controls need more frequent monitoring.

The inherent risk level of the process.

Higher risk may require more frequent monitoring.

Avoid the risk by discontinuing the activity

Avoidance eliminates risk entirely.

Implement compensating controls to reduce risk

Controls mitigate risk to an acceptable level.

Transfer the risk through outsourcing

Outsourcing can transfer risk to a vendor if properly managed.

Risk owner

Assigning an owner ensures accountability for managing the risk.

Root cause

Understanding root cause helps in risk analysis and treatment.

Risk description

A clear description is fundamental to identify the risk.

Contract compliance reviews

Ensuring vendors meet contractual security requirements is essential.

Ongoing monitoring via annual reassessments

Continuous or periodic monitoring ensures risk posture is maintained.

Initial onboarding assessment including security questionnaires

Onboarding assessment is critical to evaluate risks before engagement.

Segmentation of networks into zones and conduits

Defense-in-depth zones and conduits are core concepts.

Implementation of security levels (SL) for control systems

IEC 62443 defines SLs to categorize required security robustness.

Documented risk response strategy (e.g., avoid, mitigate, transfer, accept)

The chosen strategy is a fundamental part of the plan.

Assigned ownership and accountability

Clear ownership ensures execution and accountability.

Resource allocation and budget

Resources needed to implement the response must be defined in the plan.

Migrating to a different technology platform

Changing platforms can avoid risks of the old platform.

Discontinuing a high-risk business process

Eliminates the risk by stopping the activity.

Likelihood

Likelihood is one dimension of risk.

Impact

Impact is the other dimension of risk.

Inherent risk score

Residual risk is based on inherent risk reduced by controls.

Control design adequacy

Design adequacy is part of control effectiveness assessment.

Control operating effectiveness

Operating effectiveness is critical; if not effective, controls provide less reduction.

Event

The event describes the action or occurrence (e.g., data exfiltration) that leads to impact.

Actor

The actor is the threat source (e.g., nation-state, insider) and is a core component of a risk scenario.

Threat type

The threat type describes the nature of the threat (e.g., malware, unauthorized access) and is essential.

Emerging risks and trend analysis of key risk indicators over the past quarter.

Trends and emerging risks support proactive oversight.

A risk heat map showing the current likelihood and impact of top risks.

Visual summary is effective for board communication.

A summary of current risk exposure relative to the board-approved risk appetite.

Directly addresses board's responsibility for risk oversight.

Legal fees from lawsuits

Legal fees can be indirect or direct; in this context, they are often indirect costs of defending lawsuits.

Lost customer business

Lost business is an indirect cost.

Reputation damage leading to lower stock price

Reputation impact is indirect financial.

51% attack on the underlying consensus mechanism.

Consensus attacks are specific to blockchain.

Smart contract vulnerabilities leading to unintended execution.

Smart contracts are a unique attack surface.

Cryptographic key management failures.

Key management is critical in blockchain.