Risk Management & Assessment Flashcards

Which U.S. framework from NIST organizes federal risk management into steps such as categorize, select, implement, assess, authorize, and monitor?

Answer: Risk Management Framework (RMF, SP 800-37)

NIST SP 800-37 defines the Risk Management Framework used across federal information systems.

Which of the following best describes 'risk appetite'?

Answer: The amount of risk an organization is willing to pursue to achieve its objectives

Risk appetite is the broad level of risk an organization is prepared to accept in pursuit of its goals.

Why should risk communication be tailored to different audiences?

Answer: Executives need decision-focused summaries while operational staff need actionable details

Different stakeholders need different levels of detail to make decisions or take action.

Key risk indicators (KRIs) are primarily used to:

Answer: Provide early warning that risk exposure is rising toward tolerance limits

KRIs are metrics that signal changes in risk exposure, allowing proactive action before limits are breached.

The 'three lines' model of risk governance places which function as the second line?

Answer: Risk management and compliance oversight functions

The second line includes risk and compliance functions that oversee and support first-line management.

How often should a risk register be reviewed?

Answer: Regularly throughout the life cycle, since risks change over time

Risks evolve, so ongoing monitoring and updates keep the register accurate and useful.

A risk assessment finds a vulnerability but no credible threat can exploit it. How should the risk be viewed?

Answer: Lower, because risk requires both a threat and a vulnerability

Risk arises from a threat exploiting a vulnerability to cause impact, so the absence of a credible threat reduces overall risk.