CRISC PACKAGE DEAL

What is the difference between a standard and a policy? - ️️Standard = A mandatory action, explicit rules, controls or configuration settings that are designed to support and conform to a policy. A standard should make a policy more meaningful and effective by including accepted specifications f...

Which of the following is the MOST important reason for conducting security awareness programs throughout an enterprise? A. Reducing the risk of a social engineering attack B. Training personnel in security incident response C. Informing business units about the security strategy D. Maintaining...

R1-1 Which of the following is MOST important to determine when defining risk management strategies? A. Risk assessment criteria B. IT architecture complexity C. An enterprise disaster recovery plan D. Business objectives and operations - ️️D is the correct answer. Justification: A. Inform...

CRISC Scope - ️️Focuses on risk assessment, treatment, and monitoring. These are methods, processes and protocols used and governed withing a larger enterprise risk mgmt. framework. What does CRISC not address? - ️️CRISC does not address what's detailed in ISO31000 on how to create a ris...

How many steps in NIST RMF? - ️️6 Name steps of the NIST RMF - ️️1) Categorize Info Systems 2) Select Security Controls 3) Implement Security Controls 4) Assess Security Controls 5) Authorize Info Systems 6) Monitor Security Controls What are the layers of COBIT? - ️️Governanc...

R1-1 Which of the following is MOST important to determine when defining risk management strategies? A. Risk assessment criteria B. IT architecture complexity C. An enterprise disaster recovery plan D. Business objectives and operations - ️️D is the correct answer. Justification: A. Inform...

An enterprise recently developed a breakthrough technology that could provide a significant competitive edge. Which of the following FIRST governs how this information is to be protected from within the enterprise? A. The data classification policy B. The acceptable use policy C. Encryption sta...

risk assessment report - ️️documentation of results of the process used to identify and evaluate risk and it potential effects. naming those areas that present the highest risk, vulnerability or exposure, also used to manage the project delivery and project benefit risk. how does an organizat...