Risk Response and Reporting — CRISC Practice Questions

After integrating cybersecurity supply‑chain risk responses into the enterprise risk register, a health‑care organization must maintain ongoing visibility of those responses. Which activity best fulfills the monitoring and reporting requirement described in NIST SP 800-161r1?

• A.Periodically update the CSRR with the cost, status, and effectiveness of each risk response
• B.Shift all monitoring responsibilities to the procurement department without additional oversight
• C.Conduct a one‑time audit of all supplier contracts to verify compliance
• D.Rely solely on suppliers' self‑reported security questionnaires without independent verification

Why: Maintain continuous monitoring of supply‑chain risk responses through regular CSRR updates NIST SP 800-161r1 states that information about selection and projected cost of risk response is used to maintain a composite view, requiring periodic updates of the CSRR.

A mid‑size manufacturing company has identified a vulnerability that could allow unauthorized access to its production control system. The risk practitioner must align the response with a control framework. What should the practitioner do first?

• A.Select a preventative control to block the vulnerability
• B.Select a corrective control to remediate any breach
• C.Select a detective control to monitor for exploitation
• D.Conduct a control gap analysis against a recognized framework

Why: Identify the initial step of aligning controls with a framework before choosing control types NIST SP 800-221 emphasizes that people, processes, and technology combine to provide risk management controls and that selecting appropriate controls requires first analyzing gaps against a control baseline or framework. Conducting a control gap analysis ensures the chosen control type (preventive, detective, etc.) is aligned with the organization’s framework and risk tolerance.

SecureBank, a regional bank, has identified a critical vulnerability in its online‑banking platform and must choose a response. According to NIST guidance, who is ultimately accountable for selecting and assigning the risk response?

• A.The Chief Information Security Officer who designs controls
• B.The enterprise Risk Executive overseeing the ERM program
• C.The Authorizing Official who approves risk decisions
• D.The System Owner who operates the platform

Why: Assign accountability for risk‑response decisions to the designated risk owner, not to the operational manager NIST IR 8286 states that the risk owner is accountable for applying priorities to select and assign risk responses, and it distinguishes accountability from responsibility – often assigning accountability to an Authorizing Official.

A company has identified an opportunity to adopt a new, more secure vendor‑managed service. Which positive ICT risk response type best supports increasing the likelihood and benefit of this opportunity?

• A.Share
• B.Realize
• C.Enhance
• D.Accept

Why: Use the 'Enhance' response to increase the probability and positive impact of a supply‑chain opportunity. NIST SP 800-221 defines 'Enhance' as increasing the probability and positive impact of an opportunity, which matches the scenario.

Which control type aligns with the “Detect” function of the Cybersecurity Framework?

• A.Detective
• B.Deterrent
• C.Corrective
• D.Preventive

Why: Map control types to Cybersecurity Framework functions Detective controls provide warning of a successful or attempted threat event, matching the Detect function per NIST SP 800-221.

When drafting contracts with critical suppliers, which element is essential to align with NIST supply‑chain risk guidance?

• A.A statement that the organization will bear all security‑related costs for the supplier.
• B.Specific cybersecurity risk requirements that are prioritized and integrated into the agreement.
• C.A unilateral termination clause that allows the organization to end the contract without notice.
• D.Only generic confidentiality clauses without measurable security metrics.

Why: Embed prioritized cybersecurity risk requirements into supplier contracts. NIST SP 800-61r3 GV.SC-05 mandates that cybersecurity supply‑chain risk requirements be established, prioritized, and integrated into contracts.

During a routine vulnerability scan, a security finding is identified. What should the risk practitioner do first to manage this finding?

• A.Document the finding in an audit report and close it
• B.Escalate the finding to senior management for budget approval
• C.Assign a risk owner and record the finding in a risk detail record
• D.Implement a technical control to mitigate the vulnerability immediately

Why: Document the finding and assign ownership before remediation NIST IR 8286 specifies that a risk detail record should capture the roles involved, such as the risk owner, and record the issue for tracking and response planning.

How should cybersecurity supply‑chain risk responses be recorded to align with enterprise‑wide risk management?

• A.Document the supply‑chain risk response in the enterprise risk register alongside other risks.
• B.Treat supply‑chain risks in a separate, siloed register managed only by procurement.
• C.Wait for a supply‑chain‑specific incident before updating the enterprise risk register.
• D.Assign all supply‑chain risk response responsibilities solely to the IT security team without cross‑functional coordination.

Why: Integrate supply‑chain risk responses into the overall enterprise risk register. NIST SP 800-161r1 states that supply‑chain risk response information is added to the cybersecurity risk register, which is part of the overall enterprise risk register.

Risk governance requires that risk‑owner accountability be documented and reviewed regularly. Which group should ensure this documentation aligns with the enterprise risk program?

• A.The internal audit function should verify the accountability and record findings.
• B.The compliance function should review the accountability and approve assignments.
• C.The risk executive function should define the accountability and ensure documentation.
• D.The system owner should document the accountability and log actions in the register.

Why: Risk executive function defines and maintains documentation of risk‑owner accountability. NIST IR 8286 states that ERM leadership (risk executive function) must specify frequency and method for risk‑owner accountability, making it responsible for documentation.

A legacy system team requests an exception to the organization’s encryption baseline. Which element must be captured in the exemption record before approval?

• A.The planned timeline for replacing the legacy system
• B.The estimated cost savings from not implementing encryption
• C.The vendor’s contract terms related to the legacy system
• D.The risk owner’s signature and justification for the exception

Why: Capture risk‑owner approval and rationale in exemption records NIST IR 8286 requires that risk decisions include the roles involved and their rationale, making the risk owner’s signed justification essential.

Which control type is most appropriate for reducing the likelihood that a threat actor will attempt an attack?

• A.Deterrent
• B.Detective
• C.Preventive
• D.Corrective

Why: Identify the control type that best reduces threat likelihood Deterrent controls are designed to reduce the likelihood of a threat event by dissuading a threat actor, as described in NIST SP 800-221.

What should the risk practitioner do first when selecting a control framework to support the organization’s risk response strategy?

• A.Conduct a cost‑benefit analysis of candidate controls
• B.Identify the organization’s risk tolerance
• C.Assign ownership for each control
• D.Review all available control frameworks

Why: Align control framework selection with organizational risk tolerance Understanding the organization’s risk tolerance is the initial step to ensure any chosen framework aligns with the risk frame, as outlined in NIST SP 800-12r1.