Professional Practice Two - Risk Evaluation And Control

Question 0

BCP demonstrates work with management to gain a standardized risk assessment methodology by (a)

Answer 0

Identify risk analysis methodologies and tools using Qualitative, quantitative, advantage and disadvantage, data and content reliability/confidence factors and math formulas.

Question 1

What is the Professional’s Role in Practice Two?

Answer 1

1)Work with management to gain agreement on standardized risk assessment. 2) Identify, develop and implement information gathering, 3) Identify probabilities and impact of the threat/risks identified, 4) Identify and evaluate the effectiveness of current controls, 5) Identify business resiliency strategies to control, mitigate, accept the impact of the risk or reduce the vulnerabilities, 6) Document and present risk/threat/vulnerability assessment and recommendations to the entity’s leadership for approval.

Question 2

BCP demonstrates work with management to gain a standardized risk assessment methodology by (b)

Answer 2

Select appropriate methodology and tool for entity-wide implementation which parallel the entity’s risk tolerance level.

Question 3

BCP demonstrates work with management to gain a standardized risk assessment methodology by (c)

Answer 3

Work with the entity’s leadership to gain an understanding of the entity’s tolerance for risk

Question 4

BCP demonstrates work with management to gain a standardized risk assessment methodology by (d)

Answer 4

Work with management to select an appropriate cost benefit analysis model.

Question 5

BCP demonstrates work with management to gain a standardized risk assessment methodology by (e)

Answer 5

Establish the measurement criteria necessary to quantify the risk identified and effectiveness of existing controls.

Question 6

How would BCP identify, develop and implement information gathering activities (a)

Answer 6

Determine methods of information gathering

Question 7

How would BCP identify, develop and implement information gathering activities (b)

Answer 7

Collaborate with security, legal counsel, IT security, and other areas to identify risk and vulnerabilities.

Question 8

How would BCP identify, develop and implement information gathering activities (c)

Answer 8

Determine Information sources to be used to collect data on risk.

Question 9

How would BCP identify, develop and implement information gathering activities (d)

Answer 9

Determine the credibility of the information source.

Question 10

How would BCP identify, develop and implement information gathering activities (e)

Answer 10

Develop a strategy to gather information consistent with the entity’s policies.

Question 11

How would BCP identify, develop and implement information gathering activities (f)

Answer 11

Develop a strategy to gather information that can be managed across all of the divisions and locations.

Question 12

How would BCP identify, develop and implement information gathering activities (g)

Answer 12

Create entity-wide methods of information gathering (forms, questionnaires, interviews, meetings, or some combination)

Question 13

How would BCP identify threats/risks and the entity’s vulnerabilities? (a)

Answer 13

Identify threats/risks and vulnerabilities to taking account frequency, probability, speed of development, severity, and reputational impact for a holistic view of risk across the entity.

Question 14

How would BCP identify threats/risks and the entity’s vulnerabilities? (B)

Answer 14

Identify risk exposure from both internal and external sources. Sources- Natural, technological or acts of man, Industry/business model, Accidental vs. intentional, controllable risk vs. no control risk, prior warning risk vs. no warning.

Question 15

How would BCP identify probabilities and impact of the threat/risk identified? (a)

Answer 15

Develop a method to evaluate exposures/risk in terms of risk frequency, probability, speed of development, pre-incident warning, severity and entity impact.

Question 16

How would BCP identify probabilities and impact of the threat/risk identified? (b)

Answer 16

Identify the impact of identified risks. Risk impacts include facility, security (physical and logical), reputational, legal, customer, procedural, IT (operational infrastructure), people, supply chain, & compliance.

Question 17

How would BCP identify probabilities and impact of the threat/risk identified? (c)

Answer 17

Evaluate identified risk and classify them according to relevant criteria including risk under entities control, risk not under the control of the entity, risk with prior warning and risk with no warning.

Question 18

How would BCP identify probabilities and impact of the threat/risk identified? (d)

Answer 18

Evaluate impact of risks and vulnerabilities on those factors essential for conducting the entity’s operations by availability of IT, personnel, communication and status if infrastructure.

Question 19

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (a)

Answer 19

Identify and evaluate the effectiveness of the inherent protection afforded key assets by virtue of their location relative to sources of risk.

Question 20

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (b)

Answer 20

Identify and evaluate the effectiveness of business continuity capabilities for groups within and external to the entity on which the entity is dependent to conduct operations.

Question 21

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (c)

Answer 21

Identify and evaluate the effectiveness of actions taken to reduce the probabilities of occurrence of incidents that could impair the ability to conduct business. (Facility sightings, safety policies, training on proper use of equipment, and preventive maintenance)

Question 22

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (d)

Answer 22

Identify and evaluate the effectiveness of controls to inhibit impact exposure, i.e. Proactive controls (Security, IT security, employment practices, privacy practices)

Question 23

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (e)

Answer 23

Identify and evaluate the effectiveness of controls to compensate for impact of exposure, i.e. reactive controls (sprinkler system, fire brigade, generator, UPS system)

Question 24

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (f)

Answer 24

Evaluate security-related communications flow with other internal areas and external service providers.

Question 25

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (a)

Answer 25

Discuss strategies and controls for managing the identified risks.

Question 26

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (b)

Answer 26

Identify trigger points for key service and support areas to identify, escalate and execute strategies selected to take advantage of key risks.

Question 27

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (c)

Answer 27

Establish interruption worst-case scenarios based on risks to which the entity is exposed.

Question 28

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (d)

Answer 28

Understand options for risk management and selection of appropriate or cost-effective responses (risk avoidance, transfer, acceptance)

Question 29

How would BCP identify and evaluate the effectiveness of current controls and safeguards? (e)

Answer 29

Develop formal “risk acceptance” documentation and re-evaluation practices in conjunction with the entity risk tolerance.

Question 30

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (b)

Answer 30

Identify trigger points for key service and support areas to identify, escalate and execute strategies selected to take advantage of key risks.

Question 31

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (c)

Answer 31

Establish interruption worst-case scenarios based on risks to which the entity is exposed.

Question 32

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (d)

Answer 32

Understand options for risk management and selection of appropriate or cost-effective responses

Question 33

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (e)

Answer 33

Develop formal “risk acceptance” documentation and re-evaluation practices in conjunction with the entity risk tolerance.

Question 34

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (f)

Answer 34

Make recommendations on feasible, cost-effective security measures required to prevent/reduce security-related risks and exposures.

Question 35

How would BCP identify business resiliency strategies to control, mitigate, accept the impact of risk/threat or reduce the entity’s vulnerabilities? (g)

Answer 35

Recommend changes to reduce impact due to risks and vulnerabilities. (Physical protection & Logical protection)

Question 36

How would BCP document and present risk assessment to the entity’s leadership for approval? (a)

Answer 36

Prepare a risk assessment report, standardizing the analysis across the entity

Question 37

How would BCP document and present risk assessment to the entity’s leadership for approval? (b)

Answer 37

Present findings of risk assessment
Information on risk, assessment of controls, recommends controls, control imporvement, appropriate risk transfer, document areas where management accepts risk.

Question 38

How would BCP document and present risk assessment to the entity’s leadership for approval? (c)

Answer 38

Receive approval of risk assessment recommendations.