FIDO Risk Assessment & Mitigation 1 — Questions and Answers
Question 1: What is the first step in risk assessment for FIDO Certified Authenticator professionals?
- Implementing controls immediately
- Identifying potential hazards and vulnerabilities in the specific context (Correct answer)
- Purchasing comprehensive insurance
- Delegating risk management to others
Correct answer: Identifying potential hazards and vulnerabilities in the specific context
Risk assessment begins with systematic identification of hazards and vulnerabilities specific to the FIDO Certified Authenticator practice context.
Question 2: How should FIDO professionals prioritize identified risks?
- Alphabetically by category
- Based on likelihood of occurrence combined with potential impact severity (Correct answer)
- By cost to mitigate only
- In the order they were discovered
Correct answer: Based on likelihood of occurrence combined with potential impact severity
Risk prioritization uses a matrix of probability and impact, focusing resources on risks that are both likely and consequential.
Question 3: What distinguishes risk mitigation from risk avoidance in FIDO Certified Authenticator practice?
- They are identical concepts
- Mitigation reduces impact or likelihood while avoidance eliminates the activity entirely (Correct answer)
- Mitigation is always preferred
- Avoidance is never appropriate
Correct answer: Mitigation reduces impact or likelihood while avoidance eliminates the activity entirely
Risk mitigation allows the activity to continue with reduced risk, while avoidance eliminates the risk by not engaging in the activity at all.
Question 4: Why is documentation important in FIDO risk management?
- It is optional administrative work
- It creates an audit trail and demonstrates due diligence (Correct answer)
- It only benefits legal teams during litigation
- It slows down critical operations
Correct answer: It creates an audit trail and demonstrates due diligence
Documentation in risk management creates accountability, supports decision-making, and demonstrates professional due diligence.
Question 5: What is a risk register used for in FIDO Certified Authenticator practice?
- Recording employee attendance
- Tracking identified risks with their status, controls, and owners (Correct answer)
- Filing regulatory complaints
- Managing project budgets
Correct answer: Tracking identified risks with their status, controls, and owners
A risk register is a comprehensive tool that documents all identified risks, their assessments, mitigation strategies, responsible parties, and current status.
Question 6: How often should risk assessments be reviewed in FIDO practice?
- Only after an incident occurs
- At regular intervals and whenever significant changes occur (Correct answer)
- Once at project initiation only
- Every five years at minimum
Correct answer: At regular intervals and whenever significant changes occur
Risk assessments should be living documents, reviewed regularly and updated whenever conditions, processes, or regulations change significantly.
FIDO Risk Assessment & Mitigation 1
What is the first step in risk assessment for FIDO Certified Authenticator professionals?