CRISC: Certified in Risk and Information Systems ControlDemo

Question

An organization keeps data-center security-camera footage for 30 days, although its policy requires retention for 90 days. The business owner questions whether the issue merits remediation. Which of the following is the risk manager’s BEST response?

A Evaluate the risk as a measure of probable loss.
B Identify the regulatory bodies that may highlight this gap.
C Verify if competitors comply with a similar policy.
D Highlight news articles about data breaches.

Explanation

Risk-based remediation decisions should be based on the probable loss associated with the gap, including the likelihood of a relevant event and its business impact. This assessment establishes whether the 30-day retention period creates risk significant enough to warrant remediation. NIST risk guidance similarly evaluates risk using likelihood and impact information.

Learn more

NIST IR 8286A Rev. 1: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ677

Community Discussion