Free CRISC Isaca Updates

The best way to determine the potential organizational impact of emerging privacy regulations is to conduct a privacy impact assessment (PIA). A PIA is a systematic process of identifying, analyzing, and evaluating the privacy risks and impacts of a new or existing system, process, program, or initiative that involves the collection, use, storage, or disclosure of personal information. A PIA can help to ensure that the enterprise complies with the emerging privacyregulations, and that the privacy rights and expectations of the individuals are respected and protected. A PIA can also help to identify the gaps, weaknesses, and opportunities for improvement in the enterprise’s privacy policies, procedures, and controls. Evaluating the security architecture maturity, mapping the new requirements to the existing control framework, and chartering a privacy steering committee are not as comprehensive and effective as conducting a PIA, as they do not address the specific privacy risks and impacts of the enterprise’s activities. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 192.

According to the CRISC Review Manual (Digital Version), the first course of action when a risk practitioner discovers several key documents detailing the design of a product currently in development have been posted on the Internet is to invoke the established incident response plan, which is a set of policies, procedures, and resources that enable the organization to respond to and recover from an incident that affects the confidentiality, integrity, or availability of its IT assets and processes. Invoking the incident response plan helps to:

Contain and isolate the incident and prevent further damage or loss

Identify and analyze the source, cause, and impact of the incident

Eradicate and eliminate the incident and restore normal operations

Communicate and coordinate the incident response activities and roles with the relevant stakeholders, such as the business owner, the risk owner, the senior management, and the external parties

Learn and improve from the incident and update the incident response plan and the risk register

References = CRISC Review Manual (Digital Version), Chapter 4: IT Risk Monitoring and Reporting, Section 4.1: IT Risk Monitoring, pp. 219-2201

 A vulnerability is a system flaw or weakness that can be exploited by a threat actor, potentially leading to a security breach or incident. A vulnerability that has been exploited means that a threat actor has successfully taken advantage of the vulnerability and compromised the system or network. Implementing controls can help reduce the impact of a vulnerability that has been exploited, by limiting or preventing the damage or loss caused by the security breach or incident. Controls are the mechanisms or procedures that ensure the security, reliability, and quality of an IT system or process. Controls can be classified into different types, depending on their purpose and function. The four types of controls mentioned in the question are:

Detective control: A control that monitors and detects the occurrence or attempt of a security breach or incident, and alerts the appropriate personnel or system. For example, a log analysis tool that identifies and reports any unauthorized access or activity on the system or network.

Deterrent control: A control that discourages or prevents a threat actor from exploiting a vulnerability or performing a malicious action, by increasing the perceived difficulty, risk, or cost of doing so. For example, a warning message that informs the user of the legal consequences of unauthorized access or use of the system or network.

Preventive control: A control that blocks or stops a threat actor from exploiting a vulnerability or performing a malicious action, by eliminating or reducing the vulnerability or the opportunity.Forexample, a firewall that filters and blocks any unwanted or malicious traffic from entering or leaving the system or network.

Corrective control: A control that restores or repairs the system or network to its normal or desired state, after a security breach or incident has occurred, by fixing or removing the vulnerability or the impact. For example, a backup and recovery tool that restores the data or functionality of the system or network that has been corrupted or lost due to the security breach or incident.

The best type of control for reducing the impact of a vulnerability that has been exploited is the corrective control, because it directly addresses the damage or loss caused by the security breach or incident, and restores the system or network to its normal or desired state. Corrective controls can help minimize the negative consequences of a security breach or incident, such as downtime, data loss, reputational harm, legal liability, or regulatory sanctions. Corrective controls can also help prevent or reduce the recurrence of the security breach or incident, by fixing or removing the vulnerability that has been exploited. References = Types of Security Controls, Security Controls: What They Are and Why You Need Them, Security Controls: Definition, Types & Examples.

The control environment is the set of internal and external factors and conditions that influence and shape the organization’s governance, risk management, and control functions. It includes the organization’s culture, values, ethics, structure, roles, responsibilities, policies, standards, etc.

Uncontrolled changes are changes or modifications to the control environment that are not planned, authorized, documented, or monitored, and that may have unintended or adverse consequences for the organization. Uncontrolled changes may be caused by various drivers or events, such as technological innovations, market trends, regulatory changes, customer preferences, competitor actions, environmental issues, etc.

The greatest concern when uncontrolled changes are made to the control environment is an increase in the level of residual risk, which is the amount and type of risk that remains after the implementation and execution of the risk responses or controls. An increase in the level of residual risk means that the risk responses or controls are not effective or sufficient to mitigate or prevent the risks, and that the organization may face unacceptable or intolerable consequences if the risks materialize.

An increase in the level of residual risk is the greatest concern when uncontrolled changes are made to the control environment, because it indicates that the organization’s risk profile and performance have deteriorated, and that the organization may not be able to achieve its objectives or protect its value. It also indicates that the organization’s risk appetite and tolerance have been violated, and that the organization may need to take corrective or compensating actions to restore the balance between risk and return.

The other options are not the greatest concerns when uncontrolled changes are made to the control environment, because they do not indicate the actual or potential impact or outcome of the risks, and they may not be relevant or actionable for the organization.

A decrease in control layering effectiveness means a decrease in the extent or degree to which the organization uses multiple or overlapping controls to address the same or related risks, and to provide redundancy or backup in case of failure or compromise of one or more controls. A decrease in control layering effectiveness may indicate a weakness or gap in the organization’s control design or implementation, but it does not indicate the actual or potential impact oroutcome of the risks, and it may not be relevant or actionable for the organization, unless the control layering is required or recommended by the organization’s policies or standards.

An increase in inherent risk means an increase in the amount and type of risk that exists in the absence of any risk responses or controls, and that is inherent to the nature or characteristics of the risk source, event, cause, or impact. An increase in inherent risk may indicate a change or variation in the organization’s risk exposure or level, but it does not indicate the actual or potential impact or outcome of the risks, and it may not be relevant or actionable for the organization, unless the inherent risk exceeds the organization’s risk appetite or tolerance.

An increase in control vulnerabilities means an increase in the number or severity of the weaknesses or flaws in the organization’s risk responses or controls that can be exploited or compromised by the threats or sources of harm that may affect the organization’s objectives or operations. An increase in control vulnerabilities may indicate a weakness or gap in the organization’s control design or implementation, but it does not indicate the actual or potential impact or outcome of the risks, and it may not be relevant or actionable for the organization, unless the control vulnerabilities are exploited or compromised by the threats or sources of harm. References =

ISACA, CRISC Review Manual, 7th Edition, 2022, pp. 19-20, 23-24, 27-28, 31-32, 40-41, 47-48, 54-55, 58-59, 62-63

ISACA, CRISC Review Questions, Answers & Explanations Database, 2022, QID 174

CRISC Practice Quiz and Exam Prep