Risk Response and Reporting practice questions

Tactical risk reporting

Tactical risk reporting targets senior management such as the CISO, translating risk into business-unit and control-level detail over a quarterly cycle. Strategic reporting serves the board, while operational reporting serves process owners, so tactical matches the CISO audience and quarterly cadence.

SOC 2 Type II report

SOC 2 Type II reports audited evidence that controls operated effectively across a period, not just at a point in time. For a critical vendor holding sensitive data, this independent assurance satisfies the minimum requirement to verify sustained control effectiveness.

Quarterly

Tactical reporting to the CISO or CIO balances oversight with operational relevance, and quarterly intervals match the typical strategic-tactical planning cycle. Weekly reporting suits operational management, while annual reporting is too infrequent for tactical decision-making.

Continuous monitoring via shared threat intelligence platforms

Shared threat intelligence platforms give continuous, near-real-time visibility into vendor security posture and emerging threats, satisfying the stem's requirement for ongoing monitoring. Point-in-time reviews cannot detect changes between assessments, so continuous feeds address the monitoring gap directly.

Annual reassessment of vendor risk

Annual reassessment provides a scheduled, repeatable review of vendor risk posture, forming part of ongoing monitoring across the vendor lifecycle. It complements continuous feeds by validating controls and contractual compliance at defined intervals, satisfying the stem's requirement for essential monitoring components.

Quarterly control testing by the risk function

Quarterly testing by the risk function establishes a defined, recurring frequency and assigns ownership to an independent second-line team, both hallmarks of a periodic control effectiveness testing programme. It provides consistent evidence across the reporting cycle rather than one-off assurance.

Internal audit review of controls

Internal audit review supplies independent, objective assessment of control design and operation, a common element of periodic testing programmes. Its separation from control owners strengthens assurance credibility and supports governance reporting to the board and audit committee.

Annual penetration testing

Annual penetration testing provides periodic, independent technical validation that controls resist real-world attack techniques. Its scheduled recurrence and adversarial method make it a recognised element of a periodic control effectiveness testing programme, complementing continuous monitoring and internal review activities.

Intrusion detection system (IDS)

An IDS monitors network traffic and system activity, then alerts on suspicious events after they occur, satisfying the detection requirement. Unlike preventive controls such as firewalls, which block traffic inline, it identifies intrusions in progress or already past, enabling timely incident response.

Failed authentication spike

A spike in failed authentication attempts is a leading indicator: it precedes a successful credential-based compromise, signalling active brute-force, password-spraying or stuffing attempts. Confirmed breaches or helpdesk password resets are lagging or reactive, so the spike satisfies the stem's forward-looking requirement.

Resource requirements

Resource requirements determine whether the control can actually be implemented within budget, staffing and timeline constraints. Assessing them during planning exposes funding or skills gaps early, allowing the risk practitioner to adjust scope or escalate before commitment, which is essential when remediating a high-risk vulnerability.

Control implementation plan

A control implementation plan sequences tasks, assigns ownership, sets milestones and defines rollback and testing steps. Without it, remediation of the high-risk vulnerability risks slipping or being applied inconsistently. It translates the chosen control into an executable, trackable schedule with clear accountability.

Require the vendor to remediate the issues and provide an updated report within a defined timeframe

Remediation with a defined deadline preserves the vendor relationship while closing the qualified-opinion gap against the unqualified SOC 2 Type II requirement. Terminating or accepting the vendor would breach risk appetite or lose a critical supplier, making remediation the proportionate response.

Intrusion detection system (IDS)

An IDS inspects network traffic and host activity, generating alerts when it matches signatures or anomalies indicating intrusion. Detection occurs during or after the event rather than blocking it, which distinguishes it from preventive controls and satisfies the detective-control criterion.

Control performance metrics

Control performance metrics evidence whether mitigating controls are operating as designed, which is the operational detail a CISO needs to judge residual risk. Strategic posture and long-range trend data belong in board-level strategic reporting, not a tactical report.

Top risks and their status

Top risks and their status give the CISO a prioritised view of current exposure and treatment progress, which is the core content of tactical reporting. Enterprise risk appetite statements and long-horizon strategic themes belong at board level, not in a tactical report.

Continuous SIEM monitoring for security alerts

Continuous SIEM monitoring ingests event logs and correlates them in real time, generating alerts on security incidents as they occur. This satisfies the stem's requirement for continuous monitoring by providing ongoing, automated detection rather than periodic review, directly evidencing that IT controls operate effectively between scheduled assessments.

Weekly vulnerability scanning of critical systems

Weekly vulnerability scanning runs on a fixed recurring schedule against critical systems, giving repeated automated visibility of emerging weaknesses. Its regularity and automation satisfy the continuous monitoring criterion, distinguishing it from one-off assessments or annual penetration tests.

Monthly conference calls with vendor management

Monthly conference calls provide recurring governance oversight, letting management question the vendor's handling of sensitive data and probe emerging risks between formal reviews. This satisfies the stem's "ongoing monitoring" constraint by maintaining continuous engagement with a high-risk third party, complementing rather than replacing periodic on-site audits or technical controls.

Continuous monitoring via threat intelligence sharing platforms

Threat intelligence sharing provides near-real-time visibility of compromises, vulnerabilities and campaigns affecting the vendor, enabling action before contractual reviews occur. This continuous external feed complements periodic assessments, directly addressing the elevated exposure created by the vendor's sensitive data access.

$220,000

Correct calculation: ALE reduction minus total annualized cost.

Updating relevant documentation

Documentation updates embed the new access control system into operational procedures, ensuring administrators and users follow consistent provisioning and review steps. This satisfies the integration constraint by translating the control's design into repeatable daily practise, so it remains enforced rather than degrading after go-live.

A leading indicator of vulnerability risk

Unpatched vulnerabilities older than 30 days precede exploitation, so the metric forecasts future breach likelihood rather than reporting incidents already realised. Tracking it against the threshold of 5 gives advance warning, which is precisely what distinguishes a leading indicator from a lagging one.

Document the risk acceptance and rationale in the risk register

Acceptance is a valid response, but it must be recorded formally. Documenting the decision and its rationale in the risk register preserves the audit trail, keeps the residual risk visible to stakeholders, and demonstrates that the risk owner consciously accepted the 15% control failure.

Evaluating contract compliance requirements

Evaluating contract compliance requirements verifies the vendor can meet agreed security, privacy and service obligations before onboarding. For a high-risk vendor, this satisfies the initial assessment constraint by confirming contractual controls exist to govern the relationship and provide recourse if obligations are breached.

Reviewing SOC 2 Type II report

A SOC 2 Type II report provides independent assurance over the vendor's controls across a period, not just a point in time. For a high-risk vendor, this satisfies the onboarding assessment constraint by evidencing operating effectiveness of security controls before sensitive data or access is granted.

Reviewing completed security questionnaires

Completed security questionnaires capture the vendor's self-reported control posture across relevant domains, highlighting gaps needing follow-up. For a high-risk vendor, this satisfies the initial onboarding assessment constraint by gathering structured evidence to scope deeper due diligence and set risk-based contractual requirements.

Control performance metrics

Control performance metrics reveal whether existing controls operate effectively, giving the CISO evidence to direct remediation and resource allocation tactically. Unlike strategic risk appetite statements or long-range trend forecasts, they expose current control gaps requiring near-term management action.

Percentage of blocked intrusion attempts

Percentage of blocked intrusion attempts measures the firewall's actual enforcement outcome against detected threats. This satisfies the KCI constraint by indicating control effectiveness rather than activity volume, since a high block rate evidences the rule set is identifying and denying malicious traffic as intended.