03. Risk Monitoring and Reporting Flashcards
Risk Monitoring and Reporting
The process of ongoing activities, including control effectiveness assessments and risk assessments, used to observe changes in risk
Risk Monitoring
189
Risk Monitoring and Reporting
Security Managers perform risk monitoring to report…
risk levels to executive management and identify unexpected changes in risk levels
189
Risk Monitoring and Reporting
Typical activities that contribute to risk monitoring
- Internal audits
- Control self-assessments
- Vulnerability assessments
- Risk assessments
189
Risk Monitoring and Reporting
The audience of risk monitoring is executive management. Information security managers should describe risks as they pertain to..
business impacts and opportunities
Executive management do not care for technical detail. They assume you or the security team will be technical experts in your field
189
Key Risk Indicators
A measure of information risk used to reveal trends related to levels of risk of security incidents in the organisation
Key Risk Indicators
(KRI)
Security metrics designed to serve as early indicators of rising or falling risk
189
Key Risk Indicators
The percentage of vulnerabilities in systems supporting revenue operations that are remediated in less than 30 days is a good example of how of a KRI that is present in a manner that…
Exectutive manamgent can relate to
190
Key Risk Indicators
KRIs which communicate increases or decreases in the probability of future security incidents and events is a…
leading indicator
190
Training and Awareness
Information on safe computing, security policy, security procedures, workers security-related responsibilities can be imported to all workers in the organisation through a…
Security awareness program
190
Risk documentation
a purpose behind documenting business processess is so that they can be…
performed consistently and correctly
190
Risk Documentation
An organisations risk management program should be fully documented to include…
- Policy and Objectivies
- Roles and Responsibilities
- Methods and Techniques
- Locations for data storage and archives
- Risk tolerance
- Business rules relating to the risk register
- Risk treatmet
- Procedures and methods for metrics and KRIs
- Communication and escalation protocols
- Review cycle
191
