The Certified in Risk and Information Systems Control (CRISC)

According to the FIC Article by FSCA, accountable institutions remain fully accountable, responsible and liable for any compliance failures that may result from or be associated with an outsourcing arrangement and as such, liability and/or culpability for non-compliance with the FIC Act obligations cannot be transferred to a third-party service provider2. Therefore, even if a business process is outsourced to a cloud service provider, the organization still has the ultimate responsibility and accountability for the risk associated with the outsourced process. The other options are not correct, as they imply that the cloud service provider can take over the accountability or responsibility for the risk, or that the organization can mitigate the risk by acquiring insurance, which is not the case.

Unauthorized modification of data by a database administrator is a security risk that involves altering, deleting, or inserting data on a database without proper authorization or approval, by a person who has privileged access to the database, such as a database administrator12.

The best control to detect unauthorized modification of data by a database administrator is to review database activity logs, which are records that capture and store the details and history ofthe transactions or activities that are performed on the database, such as who, what, when, where, and how34.

Reviewing database activity logs is the best control because it provides evidence and visibility of the database operations, and enables the detection and reporting of any deviations, anomalies, or issues that may indicate unauthorized modification of data by a database administrator34.

Reviewing database activity logs is also the best control because it supports the accountability and auditability of the database operations, and facilitates the investigation and resolution of any unauthorized modification of data by a database administrator34.

The other options are not the best controls, but rather possible measures or techniques that may supplement or enhance the review of database activity logs. For example:

Reviewing database access rights is a measure that involves verifying and validating the permissions and privileges that are granted or revoked to the users or roles who can access or modify the data on the database56. However, this measure is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the database administrator has legitimate access rights to the data56.

Comparing data to input records is a technique that involves matching and reconciling the data on the database with the original or source data that are entered or imported into the database, and identifying and correcting any discrepancies or errors78. However, this technique is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the input records are also modified or compromised78.

Reviewing changes to edit checks is a technique that involves examining and evaluating the modifications or updates to the edit checks, which are rules or validations that are applied to the data on the database to ensure their accuracy, completeness, andconsistency9 . However, this technique is not the best control because it does not directly detect unauthorized modification of data by a database administrator, especially if the edit checks are bypassed or disabled9 . References =

1: Database Security: Attacks and Solutions | SpringerLink2

2: Unauthorised Modification of Data With Intent to Cause Impairment3

3: Database Activity Monitoring - Wikipedia4

4: Database Activity Monitoring (DAM) | Imperva5

5: Database Access Control - Wikipedia6

6: Database Access Control: Best Practices for Database Security7

7: Data Reconciliation - Wikipedia8

8: Data Reconciliation and Gross Error Detection9

9: Edit Check - Wikipedia

Edit Checks: A Data Quality Tool

The most effective way to incorporate stakeholder concerns when developing risk scenarios is to evaluate the risk impact. Risk impact is the extent of the potential consequences or losses that may result from arisk event. Evaluating the risk impact involves considering the stakeholder concerns, expectations, and perspectives, as they may have different views on the value of the assets, the severity of the threats, and the acceptability of the outcomes. Evaluating the risk impact can help to ensure that the risk scenarios reflect the stakeholder interests and priorities, and that the risk responses are aligned with the stakeholder objectives. Establishing key performance indicators (KPIs), conducting internal audits, and creating quarterly risk reports are not as effective as evaluating the risk impact, as they are not directly related to the development of risk scenarios, and may not capture the stakeholder concerns adequately. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 50.

Senior management involvement is a critical driver for the success of any risk management program. Without their engagement, there is a lack of strategic oversight, resource allocation, and prioritization of risk management initiatives, directly impacting the organization ' s ability to meet risk objectives. This is emphasized in theGovernance Principlesof CRISC.

An IT license audit is a process that verifies the compliance of the IT software and hardware assets with the licensing agreements and regulations. An IT license audit can reveal the existence of unlicensed copies of software, which can expose the enterprise to legal, financial, and reputational risks. The best course of action in such a situation is to report the issue to management so that appropriate action can be taken. Management can then decide on the most suitable risk response strategy, such as procuring the necessary licenses, uninstalling the unlicensed software, or negotiating with the software vendor. Reporting the issue to managementcan also help to prevent further violations, identify the root causes, and implement corrective and preventive measures. The other options are not the best course of action, as they may not address the issue effectively, efficiently, or ethically. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1.1, pp. 156-157.

The best key performance indicator (KPI) to measure the effectiveness of the security patching process is the percentage of patches installed successfully within the expected time frame. This KPI can help to evaluate how well the security patching process meets the predefined objectives and standards, and how timely the patches are applied to reduce the risk exposure. The percentage of patches installed by the security administration team, successfully during the first attempt, or without causing an unplanned system outage are other possible KPIs, but they are not as relevant as the percentage of patches installed successfully within the expected time frame. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.

 A cloud access security broker (CASB) solution is the best way to enforce access control for an organization that uses multiple cloud technologies, as it provides a centralized and consistent platform to manage and monitor the access to various cloud services and applications. A CASB solution can help to implement and enforce the enterprise’s access policies and standards, as well as to detect and prevent unauthorized or malicious access attempts. Senior management support of cloud adoption strategies, creation of a cloud access risk management policy, and expansion of security information and event management (SIEM) to cloud services are not the best ways to enforce access control for an organization that uses multiple cloud technologies, as they do not provide the technical capabilities or tools to manage and monitor the access to various cloud services and applications. References = CRISC by Isaca Actual Free Exam Q & As, question 210; CRISC: Certified in Risk & Information Systems Control Sample Questions, question 210.

The identification of advanced persistent threats (APTs) is best supported by timely and relevant external information. Reviewing information from threat intelligence sources enables the organization to detect emerging threats quickly and accurately, reducing the mean time to identify APTs. While internal audits and KRIs are important, they typically focus on internal controls and risk monitoring rather than external threat detection. Thorough documentation of risk scenarios supports risk assessment but does not directly reduce detection time. Therefore, leveraging threat intelligence is the most effective approach for early identification of sophisticated threats.

 Contractually obligating the supplier to follow privacy laws is the best way to mitigate the risk of violating privacy laws when transferring personal information to a supplier, because it ensures that the supplier is legally bound to comply with the applicable laws and regulations that protect the privacy and security of the personal information. This also creates a clear accountability andliability for the supplier in case of a privacy breach, and defines the rights and obligations of both parties in relation to the personal information. The other options are not the best ways to mitigate the risk of violating privacy laws, although they may also be helpful in reducing the likelihood or impact of a privacy breach. Encrypting the data while in transit to the supplier, requiring independent audits of the supplier’s control environment, and utilizing blockchain during the data transfer are examples of technical or assurance controls that aim to protect the confidentiality, integrity, and availability of the personal information, but they do not address the legal or contractual aspects of the privacy laws. References = CRISC: Certified in Risk & Information Systems Control Sample Questions