IT Governance & Risk Management Flashcards

Under ISO/IEC 27001, what is the purpose of a Statement of Applicability (SoA)?

Answer: To list all controls selected or excluded and provide justification for each

The SoA documents which Annex A controls are applicable and implemented, which are excluded, and the justifications for all inclusion/exclusion decisions.

A CTO must prioritize IT investments under budget constraints. Which governance tool best facilitates transparent prioritization based on business value and risk?

Answer: IT portfolio management framework

IT portfolio management provides a structured approach to evaluating, prioritizing, and balancing IT investments based on strategic value, cost, and risk.

What distinguishes a Key Risk Indicator (KRI) from a Key Performance Indicator (KPI)?

Answer: KRIs provide early warning signals of increasing risk exposure while KPIs measure achievement against targets

KRIs are forward-looking metrics that signal potential risk before it materializes, whereas KPIs measure how well current objectives are being achieved.

In NIST SP 800-37 (Risk Management Framework), which step involves categorizing information systems based on the potential impact of a security breach?

Answer: Categorize

The Categorize step uses FIPS 199 criteria to classify systems by the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Which governance concept requires that no single individual controls all phases of a critical transaction or process?

Answer: Separation of duties

Separation of duties divides critical tasks among multiple individuals to reduce fraud risk and errors by ensuring no one person can complete a sensitive transaction alone.

A company's IT risk register shows a vulnerability with Critical severity but Low likelihood of exploitation. Following a qualitative risk matrix, how should this be treated?

Answer: Assess the combined risk rating and prioritize based on the resulting risk score

A qualitative risk matrix combines severity and likelihood to produce an overall risk rating, which should drive prioritization rather than treating either dimension in isolation.

What is the main distinction between IT governance and IT management as defined by ISO/IEC 38500?

Answer: Governance involves evaluating, directing, and monitoring; management involves planning and operating

ISO/IEC 38500 defines governance as the system by which IT use is directed and controlled (evaluate, direct, monitor), while management plans, builds, and operates IT in alignment with those directions.