Passed Exam Today CRISC

Software as a Service (SaaS) is a cloud computing model that provides software applications over the internet, without requiring the users to install or maintain them on their own devices. SaaS vendors are responsible for hosting, managing, and updating the software applications, and providing technical support and security to the users. The key performance indicator (KPI) that would best measure the risk of a service outage when using a SaaS vendor is the frequency and duration of unplanned downtime, which is the amount and length of time that the software applications are unavailable or inaccessible due to unexpected events, such as network failures, server crashes, power outages, cyberattacks, etc. The frequency and duration of unplanned downtime indicate the reliability and availability of the SaaS vendor, and the potential impact of the service outage on the users’ business operations and productivity. References = 3

An information asset inventory is a list of all the information assets that an organization owns or uses. It includes information such as the asset name, description, owner, location, classification,value, and dependencies. The primary objective of maintaining an information asset inventory is to provide input to business impact analyses (BIAs), which are used to identify the criticality and recovery priorities of information assets in the event of a disruption. By having an updated and accurate information asset inventory, an organization can ensure that the BIAs reflect the current state and needs of the business processes that rely on the information assets. References = CRISC Review Manual, 7th Edition, page 74.

Scheduling periodic audits is the best way to facilitate the maintenance of data classification requirements, because it helps to verify and validate that the data are classified and handled according to the established policies, standards, and guidelines, and that the data classification requirements are updated and aligned with the changes in the data environment or regulations. Data classification is a process of categorizing data according to their sensitivity, confidentiality, and value to the organization, and specifying the appropriate handling and protection measures for each category. Data classification requirements are the rules or criteria that define how data should be classified and treated. Scheduling periodic audits is the best way to ensure that the data classification requirements are followed and maintained, and that any issues or gaps are identified and addressed. Assigning a data custodian, implementing technical controls over theassets, and establishing a data loss prevention (DLP) solution are all useful ways to facilitate the maintenance of data classification requirements, but they are not the best way, as they do not provide a comprehensive and independent review and assessment of the data classification process and outcomes. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.2, page 158

 Controls are the mechanisms or procedures that ensure the security, reliability, and quality of an IT system or process. Controls can be preventive, detective, or corrective, and can be implemented at various levels, such as physical, logical, administrative, or technical. Controls should be defined during the design phase of system development because it is more cost-effective to determine controls in the early design phase. The design phase is the stage where the system requirements are translated into a detailed technical plan, which includes the system architecture, database structure, user interface, and system components. The design phase also defines the system objectives, goals, and performance criteria. Defining controls during the design phase can help ensure that the controls are aligned with the system requirements and objectives, and that they are integrated into the system design from the start. Defining controls during the design phase can also help avoid or reduce the costs and risks associated with implementing controls later in the development or operation phases, such as rework, delays, errors, failures, or breaches. References = THE SYSTEM DEVELOPMENT LIFE CYCLE (SDLC), p. 2-3, System Development LifeCycle - GeeksforGeeks, 7.3: Systems Development Life Cycle - Engineering LibreTexts, What Is SDLC? 7 Phases of System Development Life Cycle - Intetics.