CRISC Information Technology and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Incident response playbooks

  Why it's wrong here

  Incident response playbooks are operational procedures executed after a risk eventuates, not a design component of the risk management programme itself. They belong to incident management, whereas programme design covers risk appetite, governance structures and assessment methodologies.

• ✓

  Risk assessment methodology

  Why this is correct

  A risk assessment methodology defines how risks are identified, analysed, evaluated and prioritised, forming the foundation on which the entire IT risk management programme operates. Without it, consistent scoring and treatment decisions across the organisation are impossible.

• ✗

  Vendor security assessment reports

  Why it's wrong here

  Vendor security assessment reports document third-party control posture; they are an input to risk evaluation, not a design component of the programme itself. They are tempting because supplier risk genuinely belongs within risk management, and such reports would be the right artefact when assessing a specific vendor's residual risk during due diligence.

• ✗

  Network topology diagrams

  Why it's wrong here

  Network topology diagrams are technical architecture artefacts describing infrastructure layout, not a structural element of risk programme design. They support risk assessment as inputs, while the programme itself comprises governance, risk appetite, roles and reporting processes.

Go deeper

Related to this question