Information Risk Management Flashcards

Which of the following BEST describes 'inherent risk' in information security?

Answer: Risk that exists before any controls are implemented

Inherent risk is the level of risk that exists naturally before any controls or mitigations are put in place.

What is 'residual risk' in information security risk management?

Answer: The risk that remains after controls have been applied

Residual risk is the amount of risk that remains after security controls have been implemented to reduce or manage the inherent risk.

A CISM is evaluating third-party vendors. Which risk is MOST relevant to this activity?

Answer: Supply chain and third-party risk

Third-party vendors introduce supply chain and vendor risk, where weaknesses in vendor security posture can compromise the organization's own security.

Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?

Answer: To determine critical business processes and the impact of their disruption

A BIA identifies critical business processes, their dependencies, and the potential impact of disruption, which informs risk prioritization and continuity planning.

An organization is considering purchasing cyber liability insurance. From a risk management perspective, this is an example of:

Answer: Risk transfer

Purchasing cyber liability insurance transfers the financial consequences of a security event to a third-party insurer.

Which of the following is a KEY component of an effective risk communication strategy?

Answer: Translating risk findings into business terms for stakeholders

Effective risk communication requires translating technical findings into business-relevant language so that stakeholders can make informed decisions.