CRISC VCE Exam Download

Risk owners based on risk impact are the most important stakeholders to include in the cyber response team, as they are responsible for the business outcomes affected by the cyber attack and can decide on the appropriate response actions. The other options are not the most important stakeholders to include in the cyber response team, although they may be involved in the process.

The first step to reduce the likelihood of infection from the attack is to identify systems that are vulnerable to being exploited by the attack. This would help the organization to assess the scope and severity of the risk, and to prioritize the systems that need immediate protection. Identifying systems that are vulnerable to being exploited by the attack would also help the organization to apply the appropriate patches, updates, or configurations to prevent or mitigate the attack, and to isolate or disconnect the systems that are already infected or compromised. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 2, Section 2.1.2, page 60123

TheRecovery Point Objective (RPO)specifies the maximum tolerable period in which data might be lost due to an incident. In this case, the organization is indicating that it cannot afford to lose more than three hours of data, defining its RPO.

According to the CRISC Review Manual, the risk owner is the person who has the authority and accountability to manage a specific risk and its associated controls1. The risk owner is also responsible for ensuring that the risk is within the acceptable level and that the risk response is effective and efficient2. Therefore, the most appropriate owner for a newly identified IT risk is the individual who has the authority to commit organizational resources to mitigate the risk, asthey have the most interest and influence on the risk and its impact on the business objectives. The other options are not the most appropriate owners for a newly identified IT risk, as they may not have the authority or the accountability to manage the risk. The manager responsible for IT operations that will support the risk mitigation efforts may have the operational responsibility or the oversight of the risk management activities, but they may not have the authority to allocate the resources or approve the risk response. A project manager capable of prioritizing the risk remediation efforts may have the project management skills or the knowledge of the risk management process, but they may not have the accountability or the ownership of the risk or its outcomes. The individual with the most IT risk-related subject matter knowledge may have the technical expertise or the understanding of the risk and its causes, but they may not have the decision-making power or the responsibility to manage the risk or its controls. References = CRISC Review Manual, pages 32-331; CRISC Review Questions, Answers & Explanations Manual, page 822