What is the primary force for driving privacy?
Regulation
What is Confidentiality?
Maintains the secrecy and privacy of data
"need to know / least privilege"
What is Integrity?
Guarding against improper information modification, exclusion, or destruction
"authenticity"
What is Availab...
What is the primary force for driving privacy?
Regulation
What is Confidentiality?
Maintains the secrecy and privacy of data
"need to know / least privilege"
What is Integrity?
Guarding against improper information modification, exclusion, or
destruction
"authenticity"
What is Availability?
Providing timely and reliable access to information
What is the order of Information Security Risk Management Process
steps?
1) Context Establishment
2) Risk Identification
3) Risk Analysis
4) Risk Evaluation
5) Risk Treatment
What does the Risk Identification Process involve?
1) Identify Assets
2) Identify Threats
3) Identify Existing Controls
4) Identify Vulnerabilities
5) Identify Consequences
6) Risk Estimation
What are examples of Threats?
personnel, natural events, theft, terrorism, criminal acts, software
errors, mechanical failure, accidents
The IT risk action plan is an output communication from?
Chief Risk Officer and the Enterprise Risk Management Committee
What is risk Magnitude?
The impact to the enterprise when the event occurs
What are synonyms for Frequency and Magnitude?
, Likelihood and Impact
What is Risk Appetite?
The amount of risk, on a broad level, that an entity is willing tot
accept in pursuit of its mission
What is Risk Tolerance?
The acceptable level of variation that management is willing to allow
for any particular risk as it pursues its objectives
What does Risk Governance address?
Oversight of the business risk strategy for the enterprise
What are the 3 objectives of Risk Governance?
1) Establish a common risk view
2) Integrate risk management into the enterprise
3) Make risk-aware business decisions
What are the 5 components of Governance?
1) Alignment
2) Value Delivery
3) Risk Management
4) Performance Measurement
5) Resource Management
What is the difference between Responsibility and Accountability?
Responsibility belong to those who must ensure that activities are
completed successfully
VS
Accountability which applies to those who either own the required
resource or those who have the authority to approve the execution
and/or accept the outcome of an activity
What is another term for IT Risk Scenario Analysis?
Stress Test
What is the rough allocation of risk relevant to almost all
organizations?
Financial Risk (35%)
Strategic Risk (25%)
Operational Risk (25%)
Legal and Compliance Risk (15%)
What are the Four CRISC domains?
(which also represent the cyclic process of IT Risk Management)
1) IT Risk Identification
2) IT Risk Assessment
3) Risk Response and Mitigation
4) Risk and Control Monitoring and Reporting
What is a Risk?
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller munyuabeatrice92. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $9.99. You're not tied to anything after your purchase.
