IT Risk Identification Flashcards

What role does a risk owner play in the IT risk identification process?

Answer: Accountable for managing a specific risk and ensuring appropriate responses are taken

A risk owner is accountable for monitoring and managing a specific risk, including ensuring that responses are implemented and effective.

Which of the following is an example of an internal threat source?

Answer: A disgruntled employee with access to sensitive systems

Internal threat sources originate from within the organization, such as employees, contractors, or insiders with system access.

What is the difference between a vulnerability and a threat in IT risk identification?

Answer: A vulnerability is a weakness that can be exploited; a threat is a potential event that could exploit it

A vulnerability is a weakness in a system or process, while a threat is an event or actor that could exploit that weakness to cause harm.

Which CRISC concept refers to the combination of likelihood and impact of a risk?

Answer: Risk level

Risk level is the overall measure of a risk derived from its likelihood of occurrence multiplied by its potential impact on the organization.

What is the purpose of a threat landscape analysis in CRISC risk identification?

Answer: To understand current and emerging threats relevant to the organization's industry and environment

Threat landscape analysis surveys the external and internal environment to identify the types of threats most likely to affect the organization.

Which document typically provides the foundational framework for IT risk identification activities?

Answer: IT risk management policy

The IT risk management policy defines the scope, methodology, roles, and objectives that guide all risk identification activities.