Information Security Risk Management — CISM Practice Questions

A critical supplier has changed ownership and moved its data processing operations to a new geographic region. What should the information security manager do first?

• A.Trigger a risk reassessment because the ownership and location change may affect the supplier's risk profile.
• B.Maintain the current risk rating until the scheduled annual review, assuming no immediate impact.
• C.Reduce the supplier's risk rating because the larger organization is presumed to have stronger controls.
• D.Delete the supplier from the risk register, treating the change as a termination of the relationship.

Why: Changes in ownership, processing location, or service scope are material modifications that can alter threat exposure, vulnerability, and control effectiveness. ISACA guidance requires that such changes trigger a risk reassessment to determine whether the existing risk rating remains appropriate and to update treatment plans. Ongoing monitoring ensures that risk decisions reflect the current environment. The change is a material alteration that can impact risk exposure, so a reassessment is required to update the risk rating.

A new attack technique targets a technology used by the organization, but no compromise has been confirmed. What is MOST appropriate?

• A.Escalate the incident to senior management and initiate a full breach response
• B.Assess the organization’s exposure and adjust monitoring and treatment as warranted
• C.Suspend all services using the affected technology until a definitive compromise is proven
• D.Assign responsibility to the IT team to patch the technology without further analysis

Why: Threat intelligence should trigger a proportionate risk assessment, not an automatic panic response. By assessing exposure the manager determines the actual risk level and can adjust monitoring and treatment plans accordingly, ensuring resources are used efficiently while maintaining security posture. Because the technique is unconfirmed, the manager must first evaluate exposure and modify controls based on risk, rather than over‑reacting.

A vulnerability scanner reports a critical flaw on an isolated test server that contains no sensitive data. What should the assessor do?

• A.Validate the asset’s context, exploitability, exposure, and business impact
• B.Rely solely on the scanner’s severity rating to assign the risk level
• C.Patch the server immediately without confirming the vulnerability’s relevance
• D.Assign remediation to IT and schedule a change request before analysis

Why: Technical severity scores are inputs to risk assessments, but the actual risk depends on how likely the vulnerability can be exploited and the potential impact on the organization given the asset’s role. Assessors must evaluate context, exposure, and business impact before deciding on treatment. Because risk is derived from the vulnerability’s likelihood and impact within its specific business context, not just the scanner severity.

Two identified risk scenarios have the same potential impact but markedly different likelihoods. Why might their risk ratings be different?

• A.Risk is determined solely by the magnitude of impact.
• B.Risk depends only on the number of existing controls.
• C.Risk combines likelihood with potential impact.
• D.Risk is assessed based on audit frequency and findings.

Why: Risk is a function of both the probability that a threat event will occur and the severity of its consequences. In risk assessments, each scenario is plotted on a likelihood‑impact matrix, producing a risk rating that reflects both dimensions. Therefore, scenarios with equal impact but different likelihoods will receive different ratings. Because risk rating is derived from both the likelihood of occurrence and the magnitude of impact. When likelihood differs, the overall risk rating changes.

A business decides to discontinue a high‑risk online feature instead of implementing costly controls. Which risk response strategy is being employed?

• A.Risk acceptance
• B.Risk sharing
• C.Risk avoidance
• D.Risk mitigation

Why: Risk avoidance removes the source of risk by not performing the activity, making it the most definitive response. Other responses such as acceptance, sharing, or mitigation address the risk while the activity continues, often requiring controls or agreements. Discontinuing the activity eliminates the exposure, which is the definition of risk avoidance.

A compensating control has been implemented, but the residual risk remains above the organization’s risk tolerance. What should be done next?

• A.Escalate the residual risk to the authorized risk owner.
• B.Close the issue because a compensating control is in place
• C.Ask internal audit to formally accept the remaining risk
• D.Adjust the risk tolerance level to match the current exposure

Why: Compensating controls may reduce risk but not always to an acceptable level. When residual risk exceeds the defined tolerance, it must be reported to the authorized risk owner who can approve additional controls, accept the risk, or modify treatment. This ensures risk decisions remain aligned with governance and risk appetite. The risk owner has the authority to evaluate the residual risk and decide on further treatment or acceptance, so escalation is required.

If a key risk indicator breaches its threshold for two consecutive reporting periods, what is the most appropriate action?

• A.Adjust the threshold to bring the indicator back within acceptable limits
• B.Escalate per the defined trigger and evaluate a risk reassessment or treatment
• C.Monitor the indicator further and wait for an actual loss event before taking action
• D.Discontinue reporting the indicator since it has already exceeded its threshold

Why: Key risk indicators are monitored to provide early warning of risk changes. When a threshold is breached repeatedly, the defined escalation trigger ensures that management evaluates the risk’s significance and decides on reassessment or treatment, maintaining proactive risk management. A sustained KRI breach activates the escalation process defined in the risk management framework, requiring review of the risk and possible reassessment or treatment.

A business owner requests that the current system be used for six months while a replacement system is being procured. What is MOST important to do regarding this temporary risk acceptance?

• A.Remove the risk from risk registers and cease monitoring until the new system is live.
• B.Document the rationale, risk owner, acceptance period, compensating controls, and obtain formal approval.
• C.Allow the system administrator to approve the temporary use informally without documented controls.
• D.Assume that procuring the replacement system automatically eliminates the risk and take no interim action.

Why: Temporary risk acceptance must be formally documented, assigned to an owner, time‑bound, and supported by compensating controls with explicit approval. This enables ongoing monitoring and accountability until the permanent solution is implemented. It creates a formal, accountable record of why the risk is accepted, who owns it, how long it will last, what interim controls are in place, and ensures proper approval.

A privileged‑access procedure omits verification of the requester's authority. How should this be classified?

• A.A threat source
• B.An adverse impact
• C.A vulnerability
• D.Risk appetite

Why: Vulnerabilities are gaps or weaknesses in processes, systems, or controls that can be leveraged by threats. Distinguishing them from threat sources (who or what can exploit), adverse impacts (the consequences), and risk appetite (the level of risk an organization accepts) is essential for accurate risk identification and assessment. It is a weakness in a control that could be exploited, which matches the definition of a vulnerability.

A facility is located in a flood‑prone area. Which risk concept best describes this influence?

• A.Risk response option
• B.Predisposing condition
• C.Control test result
• D.Adversary decision factor

Why: Predisposing conditions are attributes of the environment, assets, or processes that raise the likelihood or impact of a threat, such as being situated in a flood‑prone area. Identifying these conditions is part of risk identification and assessment, whereas risk response, control testing, and adversary decisions address later stages of risk management. A predisposing condition is an inherent characteristic, such as location, that increases exposure to a threat event.

Vulnerability counts have fallen, but the average remediation time for critical internet‑facing systems has increased. What should management conclude?

• A.Management should assume risk has decreased because total vulnerability counts are lower.
• B.The organization should halt the vulnerability remediation program until the count trend reverses.
• C.Report only the total number of vulnerabilities without mentioning remediation times or asset criticality.
• D.The trend is mixed and requires context on exposure, asset ageing, and criticality.

Why: Risk metrics must be interpreted in context; a drop in vulnerability counts can conceal growing exposure if critical assets remain unpatched longer. Effective risk identification considers exposure, asset criticality, and ageing alongside raw counts. Because lower counts may mask longer remediation times for high‑risk assets, management must evaluate exposure, asset ageing, and criticality before judging risk change.

A data breach involving regulated personal data has been rated low risk because the likelihood of occurrence is considered remote. What should the assessor verify?

• A.Confirm that impact and regulatory obligations are considered together with likelihood.
• B.Check that the antivirus definitions are up‑to‑date on all affected systems.
• C.Verify whether the vendor contract includes a discount for the remediation services.
• D.Determine if the risk register contains fewer than ten items before proceeding.

Why: Risk assessment must consider both the probability of an event and the severity of its consequences, especially when regulated data are at stake. Even if the likelihood is remote, a breach of personal data can have significant legal, financial, and reputational impact, which must be reflected in the risk rating. Assessors should ensure that impact and regulatory obligations are integrated with likelihood in the risk evaluation. Because risk equals likelihood times impact, a low likelihood does not automatically produce low risk when impact is high; the assessor must verify that impact and regulatory obligations are considered together with likelihood.