Changed CGEIT Exam Questions

When conducting a risk assessment in support of a new regulatory requirement, the IT risk committee should first consider the risk profile of the enterprise. Understanding the overall risk landscape, including existing vulnerabilities, threats, and the impact of potential risks, provides a foundation for evaluating how new regulatory requirements will affect the organization. This initial step ensures that subsequent risk management efforts, including compliance activities, are aligned with the enterprise's risk appetite and strategic objectives. While cost, system readiness, and operational disruption are important considerations, they should be evaluated in the context of the enterprise's risk profile.

For Zero Trust architecture, which emphasizes "never trust, always verify,"evaluating the vendor’s security practices is critical. A thorough security assessment ensures that the vendor aligns with Zero Trust principles, such as identity verification, micro-segmentation, and continuous monitoring.

Although having a feature list and contracting template are important downstream activities, and benchmarking can help shortlist vendors, thecore of Zero Trust lies in trust minimization and verification. Hence, vetting a vendor's capability to enforce security controls is paramount.

The primary consideration for an enterprise when deciding whether to adopt a qualitative risk assessment method is:

The level of detail and accuracy required for the risk assessment. Qualitative risk assessment is a method that uses scenarios, subjectivity, and knowledge to evaluate risks. It does not provide specific objective measurements of exposure, but rather a relative ranking or rating of risks based on their likelihood and impact1. Qualitative risk assessment is suitable for situations where the data is scarce, uncertain, or incomplete, or where the risk assessment needs to be done quickly and easily1. However, qualitative risk assessment may also be biased, inconsistent, or inaccurate, as it depends on the judgment and experience of the risk assessors1. Therefore, an enterprise should consider the level of detail and accuracy required for the risk assessment before choosing a qualitative method. If the enterprise needs more precise and reliable estimates of risk exposure, it may opt for a quantitative method instead1.

The other options are not the primary consideration for an enterprise when deciding whether to adopt a qualitative risk assessment method. The method identifies areas to immediately address vulnerabilities, enables an analysis of recommended controls, and provides a platform for all departments to contribute to the risk assessment are all possible benefits or outcomes of using a qualitative risk assessment method, but they are not the main factor that influences the decision to use it. They may also apply to other methods of risk assessment, such as quantitative or hybrid methods2.

Incorporating IT planning into the enterprise strategic planning processensures that IT initiatives are aligned from the beginning with enterprise goals. This proactive alignment allows IT to anticipate future business needs, allocate resources in advance, and reduce reaction time to strategic shifts.

While portfolio management and representation in reviews improve execution and oversight, true proactive value comes fromstrategic integration—ensuring IT is part of the planning conversation rather than reacting post-factum.