CSPM Risk Management & Compliance Flashcards

Which element of a risk register captures the actions taken to reduce a specific risk to an acceptable level?

Answer: Risk treatment plan

The risk treatment plan within a risk register documents the specific controls, timelines, and responsibilities chosen to mitigate, transfer, avoid, or accept an identified risk.

What is the purpose of a Business Impact Analysis (BIA) in a security project?

Answer: To identify critical assets and quantify the impact of their disruption

A BIA identifies mission-critical processes and assets, then quantifies the operational and financial impact of their disruption to prioritize recovery and protection efforts.

Under the NIST Cybersecurity Framework (CSF), which function addresses identifying the steps to contain and eradicate a security event?

Answer: Respond

The Respond function of the NIST CSF encompasses activities including response planning, communications, analysis, mitigation, and improvements after a cybersecurity event.

A security project manager sets the organization's risk appetite. Risk appetite is best defined as:

Answer: The amount and type of risk an organization is willing to accept in pursuit of its objectives

Risk appetite is the overarching statement of the level of risk an organization is prepared to accept while pursuing its goals, guiding risk management decisions at all levels.

Which US law established the Federal Information Security Management Act, mandating cybersecurity programs for federal agencies?

Answer: E-Government Act of 2002 (FISMA title)

FISMA was enacted as Title III of the E-Government Act of 2002 and requires federal agencies to develop, document, and implement information security programs.

When performing a risk heat map analysis, the axes typically represent:

Answer: Likelihood vs. impact

A risk heat map plots risks on a grid with likelihood (probability) on one axis and impact (severity) on the other to visually prioritize which risks need immediate attention.