DOMAIN 3—RISK RESPONSE AND REPORTING (32%)

Outcomes of Outsourcing Noncore Processes

• Subcontracting the processing of sensitive data poses the greatest risk when outsourcing noncore processes.
• This is due to the enterprise ceding direct control of its IT processes.
• In contrast, total cost of ownership exceeding projections, loss of internal information systems experience, and lack of vendor loyalty are lesser concerns.
• TCO exceeding projections is common because TCO is based on modeling, and some variation is expected.
• Loss of internal IT experience is problematic for core processes, but not noncore ones.
• Lack of vendor loyalty is typically managed through service level agreements.

Proposing Specific Risk Treatment

• When proposing a specific risk treatment, a risk practitioner primarily uses a business case.
• A manager should base any proposed response on a risk assessment in the context of objectives and requirements, compliance, and routine processes.
• Business case development illustrates costs and benefits of risk response.
• A technical evaluation report and a vulnerability assessment report supplement the business case.
• Budgetary requirements represent one input into the business case.

Effective Risk Management

• Assigning risk to individual owners is the most important for effective risk management because it maximizes accountability.
• Regulatory compliance is a relatively small part of risk management.
• Risk management should be integrated into strategic, tactical, and operational processes.
• Risk avoidance is not always feasible in a business environment.

Outsourcing Arrangements

• When outsourcing business functions to a firm in another country, including IT development, data hosting, and support, the direct enumeration of security requirements in the outsourcing contract or agreement becomes most important for a risk professional.
• Policies and procedures and service level agreements, are of secondary consideration.
• Basing security programs on recognized international standards are also of secondary consideration

Establishing Risk Ownership

• Mapping an identified risk to a specific business process helps identify the prospective process owner.
• Aggregation of related business processes helps identify the prospective risk owner.
• Documenting interdependencies only helps identify the workflow.
• RACI charts are too general to establish ownership.
• Risk cannot be a shared responsibility.

Risk Response Report Recommendations

• Risk response reports include recommendations for acceptance, an alternative considered in the risk response process.
• Risk assessment, risk evaluation, and risk quantification are completed prior to determining appropriate risk responses.

Achieving Acceptable Risk

• Residual risk is most likely to be reduced to achieve acceptable risk.
• Residual risk is the remaining risk after management has deployed a risk response.
• Inherent risk cannot be minimized, only avoided.
• Control risk is incurred when controls fall short of their objectives, and it is not necessarily related to residual risk.
• Risk appetite doesn't change with mitigation activities, and it represents the risk an entity is willing to accept.

Denial-of-Service Vulnerability

• A global financial institution may decide to accept a specific risk associated with a denial-of-service vulnerability if the cost of the countermeasure outweighs the value of the asset and potential loss.
• While countermeasures can be too complicated to deploy, it does not necessarily mean that they are cost prohibitive.
• Any safeguards placed to prevent the risk need to match the risk impact.
• The enterprise may decide to accept a specific risk because the protection would cost more than the potential loss, not because the frequency cannot be predicted.

Two-Factor Authentication System

• Total cost of ownership is most relevant in a cost-benefit analysis of a two-factor authentication system given it establishes a cost baseline for the control's full life cycle.
• The approved budget may have no bearing on the actual cost.
• The relationship betweeen security frequency incidents and annual loss expectancy of security incidents, can measure the benefit, but the relationship is indirect because not all security incidents may be mitigated by implementing a two-factor authentication system.

Outsourcing Contract Legalities

• Having provisions to assess compliance of the provider secures the proper data handling better than other parameters in an outsourcing contract.
• While service providers may allow for independent compliance auditing, it is of secondary importance
• Encryption and incident notifications are of secondary importance as well.

Cloud Provider Services

• An ambiguous service level agreement poses the greatest risk to an enterprise that recently engaged cloud services because it is hard to determine provider compliance.
• Other customer references are of secondary consideration because they can not provide reasonable assurance that the vendor will deliver.
• Additionally, third-party audit firms are allowed in reporting under Statement on Standards for Attestation Engagements No. 18 (SSAE 18).

Enterprise Financial protection

• When is risk cannot be sufficiently mitigated through manual or automatic controls, insuring against the risk will best protect the enterprise from the potential financial impact of the risk by transferring the risk to the insurance company.
• Updating the risk registry will not change the risk, and will only change managements perception of it.
• Staff capacity to detect or mitigate the risk may potentially reduce the financial risk as well.

Cost of Mitigation

• Risk should be accepted if the cost to mitigate the risk is much greater than the benefit to be derived.
• It should be transfered.
• Risk termination while risk can generally not be terminated
• Treating the risk in the described scenario incurs a cost that is greater then the benefit to be derived

Continuity of Operations

• The relationship IT risk scenarios that impact business must be established to understand the effects of possible adverse events on enterprise objectives.
• Key risk indicators assist management in understanding potential changes in the control environment. A risk scenario more directly identifies circumstances that can adversely affect the enterprise's business or assets. Although risk and control ownership with clear lines of responsibility plays an important role in managing risk
• Risk times within the risk register helps guide the continuity and disaster recovery planning, but its constructed narrowly.

Night IT equipment arrival

• A risk practitioner receiving a message about a delay because the agreement exists with another company until equipment arrives mitigates risk by reducing impact when a risk event occurs through making plans such as reciprocal arrangements.
• Risk transfer is not the correct answer with insurance .
• standby is a risk mitigation strategy.
• if it were accepted, the enterprise would continue operating without the equipment until it was delivered.

Adequate Risk Response

• An analysis of costs and benefits for controls helps an enterprise understand if it can mitigate the risk to an acceptable level.
• The degree of change in the risk environment does not provide sufficient information on actual controls and benefits to make a decision.
• Risk can never be eliminated.

Security Investment Oppurtunity

• Deploying maximum controls across all information assets will overprotect some less critical information assets; therefore, investment will not be optimized.
• The primary focus should be identifying the important information assets and protecting them appropriately to optimize investment (i.e., important information assets get more protection than less important or critical assets).
• The security shall not be optimized for the given information assets, therefore, investment will not be optimized to deploy minimum protection across all information assets.
• Investing only after a major security event is a reactive approach that may severely compromise business operations in some cases, to the extent that the business does not survive.

Administrator Account

• Least privilege is used to reduce impact from a malicious hacker who gains access to an administrator account.
• However, given that administrators in many large enterprises specialize in particular areas, hackers often target administrative accounts because they are understood to be exempt from controls and have the widest scope of permission.
• Even in small enterprises (where one person holds multiple roles) least privilege can reduce losses that otherwise may result from compromised accounts.
• Multifactor authentication, is used to safeguard without authorization and password frequency is likely not enough for access.

Effective Risk Management Program

• Critical to an effective risk management program is risk owners are accountable, makes cost-effective business decisions regarding controls for their owned risk, and must be identify those risk.
• The risk response strategy, register, and profiles are tools that require ownership by users to apply and accountability.

Most Viable Risk Response

• Acceptance of a risk is most viable when the cost of anti-malware exceeds the loss expectancy of malware threats.
• Risk elimination is not a risk response, because it is not possible to reduce risk to zero.
• With high transfer and mitigation should be based on the expected cost.

Best Example of Risk

• "Exiting the process that gives rise to risk" provides the best example of risk avoidance behavior.
• By no taking action, this is and example of risk acceptance with an informed decision by management.
• Outsourcing a process is a example of risk transfer.

Risk Treatment Dependencies and CISO Recommendations

• Verifying through a top-down process and economically feasible constraints is how to ensure critical dependencies are addressed in the risk treatment plan.
• CISO has recommended several controls, such as anti-malware, to protect the enterprise's information systems is a Risk mitigation.
• Risk acceptance involves making an educated decision to accept the risk and taking no action.
• And risk transfers involves transferring the risk to another entity

Best risk mitigation Practice

• Performing regular audits to verify that the vendor is compliant with contract requirements.
• Reviewing vendor staff training and keeping a copy of sensitive data is unnecessary.
• Although it is common. reviewing the finances of the vendor, solvency does not guarantee the vendor can function and not best to address risk.

Best Addressed by Transferring Risk

• A building located in a 100-year flood plain.
• An fire suppression system or employee sabotage would be of little use.
• removable media policies could proactively mitigate stolen media

Risk Treatment Plan

• A cost-benefit analysis helps determine if the benefit of a control outweighs the cost of implementing the control.
• SWOT analysis and vulnerability analysis provides some benefit.

Greatest Benefiting Risk

• A. Implementing the risk treatment plan reduces the negative impact and likelihood of a risk occurrence.
• Not the appitite and and transferring is not the the only response option

Validating effectiveness of an

performing vulnerability scans.

• conducting testing is elevating risk
• change requests do mean a patch is applied.

Important factor for system design

• Stakeholder requirements are the most design factor when designing information system controls, such as development and scalable methodologies.

Most benefits with testing system

• The financial institution risk practitioner would be most benefiting from a test that identifies the introduction of potential new gaps in security, not the performance and volumes or recovery of the system.

Senior Leading

• Measuring key risk indicators is the most important to measure quantitatively and monitoring appropriaatly, not surveying
• Having vulnerabilities and those risk is immeasureable, not based on the that is available An enterprise has contracted an external supplier to develop critical components of a consumer product. Indictors are the most important aspect

Revocation of System Access

• Establishing predetermined, automatic expiration dates is the best means of revocation.

Presentation to Executive management

• A risk register dashboard provide a comprehensive overview of the risk profile in contrast to indicators and reports.

Main reason of Key Control

• ensure that controls actually mitigate risk at an effective level. Analysis of KCI