Risk Assessment Flashcards

Which PCI DSS document type formally records identified risks, their ratings, owners, and treatment plans?

Answer: Risk Register

A risk register is the formal document used to track identified risks, their assessed ratings, assigned owners, and planned or completed treatment actions.

An organization's risk assessment reveals that unencrypted PANs traverse a legacy internal network segment. The FIRST step should be:

Answer: Identify and document all data flows to determine full scope of exposure

Before remediating, fully mapping and documenting all affected data flows ensures the complete scope of the exposure is understood and remediation is comprehensive.

Which of the following BEST distinguishes inherent risk from residual risk?

Answer: Inherent risk exists before controls are applied; residual risk remains after controls

Inherent risk is the natural level of risk without any controls, while residual risk is what remains after controls have been implemented.

A PCIP reviews a risk assessment that omits insider threat scenarios. This is a gap because:

Answer: Insider threats represent a significant and commonly exploited attack vector for cardholder data theft

Insider threats are a well-documented risk to cardholder data environments and must be included in comprehensive PCI DSS risk assessments.

When using a risk matrix, a risk rated as 'Low Likelihood / High Impact' is MOST accurately described as:

Answer: A tail risk requiring monitoring and contingency planning

Low-likelihood, high-impact risks are often called tail risks; they warrant contingency planning and monitoring even if immediate mitigation isn't prioritized.

Which methodology requires organizations to evaluate risks in terms of operational resilience, people, processes, and technology in a self-directed manner?

Answer: OCTAVE Allegro

OCTAVE Allegro is a streamlined, self-directed risk assessment methodology focused on operational resilience across people, processes, and technology.

A merchant completes their annual PCI DSS risk assessment but does not reassess after migrating their payment application to a new cloud provider. This violates which principle?

Answer: Significant changes to the CDE require a new or updated risk assessment

PCI DSS requires risk assessments to be triggered by significant environmental changes such as cloud migrations, not just performed annually.