Isaca Certification CRISC Book

 According to the CRISC Review Manual (Digital Version), the most effective approach to mitigate the risk associated with data loss due to users sending sensitive information by email without using encryption is to block unencrypted outgoing emails which contain sensitive data. This is an example of a risk avoidance strategy, which aims to eliminate the risk by removing the source of the risk or the activity that causes the risk. Blocking unencrypted outgoing emails which contain sensitive data can prevent unauthorized access, disclosure, modification or destruction of the sensitive information, and thus protect the confidentiality, integrity and availability of the data. This approach can also deter users from violating the encryption policy and enforce compliance with the security standards and regulations.

References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.3: Risk Response Options, pp. 167-1681

 The best way to support risk-based decisions by senior management would be to map findings to objectives, because this would help them understand how the identified risks affect the achievement of the organization’s goals and priorities. Mapping findings to objectives would also help senior management evaluate the trade-offs between different risk responses and allocate resources accordingly. By linking risks to objectives, the risk practitioner can communicate the value and impact of risk management in a clear and relevant way. References = Risk IT Framework, ISACA, 2022, p. 17

The primary objective of promoting a risk-aware culture within an organization is enabling risk-based decision making, because this helps the organization to achieve its goals and objectives while managing its risks effectively and efficiently. A risk-aware culture is one where everyone understands the organization’s approach to risk, takes personal responsibility to manage risk in everything they do, and encourages others to follow their example. A risk-aware culture also fosters communication, collaboration, and learning about risk across the organization. By promoting a risk-aware culture, the organization can empower its employees to make informed and balanced decisions that consider both the potential benefits and the potential risks of their actions. This can enhance the organization’s performance, resilience, and competitiveness in a dynamic and uncertain environment. References = Risk IT Framework, ISACA, 2022, p. 17

The risk owner is the person who has the authority and accountability to manage a specific risk and its associated controls. The risk owner is also responsible for ensuring that the risk is within the acceptable level and that the risk response is effective and efficient. In this case, the risk owner is also the owner of the business service that depends on the managed hosting service. Therefore, the risk owner should be notified of the new information about the flood risk first, as they have the most interest and influence on the risk and its impact on the business objectives. The risk owner can then decide on the appropriate actions to take, such as reviewing the contract terms, requesting additional controls, or changing the service provider. The other options are not the correct answers because they are not the primary stakeholders of the risk and its consequences. The data center manager is an employee of the managed hosting service provider, not the organization that procured the service. The data center manager may not have the authority or the incentive to address the flood risk or inform the organization. The site manager is also an employee of the managed hosting service provider, and their role is to conduct annual risk assessments under the contract. The site manager may not be aware of the new information or have the responsibility to communicate it to the organization. The CIO is the senior executive who oversees the IT strategy and operations of the organization. The CIO may have a general interest in the managed hosting service and its risks, but they are not the direct owner or managerof the specific risk or the business service that relies on the service. References = CRISC Review Manual, pages 32-331; CRISC Review Questions, Answers & Explanations Manual, page 702