Section 4 Information security risk management program

Question 1

Risk Management

Answer 1

processes for managing risk on an ongoing basis, in order to monitor and keep it at a level na acceptable sa organization

Question 2

Understanding the Fundamentals:

How would you differentiate between risk management and risk assessment in simple terms?

Answer 2

Risk management is the continuous process of handling risks to maintain an acceptable level, while risk assessment is the specific activity of identifying, analyzing, and evaluating risks at a given moment.

Risk Management:
Definition: Continuous process.
Objective: Handling risks.
Purpose: Maintain an acceptable level of risk.

Risk Assessment:
Definition: Specific activity.
Activities: Identifying, analyzing, and evaluating risks.

Question 3

Risk Management Programs

Answer 3

Demonstrate Leadership and commitment
Assign responsibilities
Define the responsibilities
Ensure accountability
Establish a risk management policy
Establish a risk management process
Provide the resources

Question 4

How to Demonstrate Leadership and commitment

Answer 4

Implement and customize RIsk Management Framework

Pag bibigay ng statement or policy

Ensure resources are allocated

Pag assign ng authority, responsibility and accountability

Question 5

Who is accountable for managing risk?

Answer 5

Top Management

Question 6

Who is accountable for overseeing risk management?

Answer 6

oversight bodies

Question 7

Internal Interested Parties

Answer 7

1. Top Management
2. Financial Department
3. HR
4. InfoSec Manager
5. IT technician
6. Legal Department
7. Public Relations Department
8. Internal Auditor

Question 8

They are the ones most directly
affected by the risks to intangible assets, such as reputation, brand recognition, and trademarks.

Answer 8

Top Management

Question 9

Who is typically responsible for the risk management program in an organization?

Answer 9

Risk Manager

Question 10

Why is it important for the person responsible for the risk management program to be familiar with all aspects of the organization’s operations?

a. It’s a legal requirement
b. To enhance communication with stakeholders
c. To show off their knowledge
d. To increase workload

Answer 10

b. To enhance communication with stakeholders

Question 11

The core elements of the risk management process defined by ISO 31000 and ISO/IEC 27005 are:

Answer 11

Establishing the context
Risk assessment (comprising risk identification, risk analysis, and risk evaluation)
Risk treatment
Monitoring and review
Communication and consultation

Question 12

What is? ISO/IEC 27005, clause 3.2.3 Risk assessment

Answer 12

Overall process of risk identification, risk analysis and risk evaluation

Question 13

True or Flase
Infosec Risk Management Cycles
the risk assessment and risk treatment should be updated on a regular basis and based on changes

Answer 13

True

Question 14

When is the strategic cycle typically conducted in risk management?

a. Only when minor changes occur
b. At shorter time intervals
c. At longer time intervals or when major changes occur
d. On a daily basis

Answer 14

c. At longer time intervals or when major changes occur

Question 15

What does the operational cycle focus on in the risk management process?

a. Only major changes
b. Short-term risks
c. Environmental objectives
d. Long-term goals

Answer 15

b. Short-term risks

Question 16

What is the primary focus of the strategic cycle in the risk management process?

a. Short-term goals
b. Detailed risk assessments
c. Achieving organizational objectives
d. Daily operational activities

Answer 16

c. Achieving organizational objectives

Question 17

How often should the operational cycle be conducted?

Answer 17

c. Depending on detailed risks and changes

Question 18

In which cycle can there be many risk assessments with different contexts and scope?

a. Only in the strategic cycle
b. Only in the operational cycle
c. Both in the strategic and operational cycles
d. In neither cycle

Answer 18

c. Both in the strategic and operational cycles

Question 19

Who is responsible for following up on the implementation of risk management recommendations?

The HR
The risk manager
The top management

Answer 19

The risk manager

The risk manager is responsible, among others, for ensuring the follow-up of the implementation of recommendations.

Question 20

Who is responsible for ensuring that resources are allocated for risk management?
The top management
The risk manager
The internal auditor

Answer 20

Top management is responsible for ensuring that the necessary resources are allocated to managing risk.

Question 21

Which of the following is considered as a resource for risk management?
Documented processes and procedures
People and skills
Both A and B

Answer 21

Both A and B

Top management and oversight bodies should ensure allocation of appropriate resources for risk management, including, among others, people, skills, experience, competence, documented processes and procedures, and information and knowledge management systems.

Question 22

What is the primary goal of risk management?
a. Identifying risks
b. Analyzing risks
c. Managing risks on an ongoing basis
d. Evaluating risks at a certain point in time

Answer 22

c. Managing risks on an ongoing basis

Question 23

How is risk assessment defined?
a. A permanent program in the organization
b. A set of processes for managing risk
c. The process of identifying, analyzing, and evaluating risks
d. Monitoring and keeping risks at an acceptable level

Answer 23

c. The process of identifying, analyzing, and evaluating risks

Question 24

Is risk management a permanent program in the organization?
a. Yes, always
b. No, only at certain times
c. It depends on the organization
d. Only during major changes

Answer 24

a. Yes, always

Question 25

approves risks, holds overall responsibility.

Answer 25

Top management

Question 26

Department that analyzes costs, manages financial resources.

Answer 26

Financial Dept.

Question 27

Department that identifies training needs, contributes to risk awareness.

Answer 27

HR

Question 28

Who proposes controls for risk management.

Answer 28

InfoSec Manager

Question 29

Who implements technical solutions for daily operations.

Answer 29

IT technician

Question 29

Department that identifies requirements for compliance (legal, regulatory, and contractual) and its analysis

Answer 29

Legal Dept.

Question 30

Who validates impacts on organization’s reputation, manages external communications.

Answer 30

Public Relations (PR)

Question 31

Who validates security control compliance.

Answer 31

Internal auditor

Question 32

They are the ones most directly
affected by the risks to intangible assets, such as reputation, brand recognition, and trademarks.

Answer 32

Top Management

Question 33

Who is typically responsible for the risk management program in an organization?

a. CEO
b. Risk Manager
c. IT Manager
d. Marketing Manager

Answer 33

b. Risk Manager

Question 34

Why is it considered a good practice to assign the risk management role to the risk manager?

a. To increase workload
b. Because it’s a legal requirement
c. The risk manager is familiar with all aspects of the organization’s operations
d. It’s a temporary role

Answer 34

c. The risk manager is familiar with all aspects of the organization’s operations

Question 35

With whom should the risk manager interact effectively?

a. Only with business managers
b. Only with support services staff
c. Both business managers and support services staff
d. Only with the CEO

Answer 35

c. Both business managers and support services staff

Question 36

Why should the person responsible for risk management be familiar with all aspects of the organization’s operations?

a. It’s a legal requirement
b. To increase workload
c. To effectively manage risks in different areas
d. Only for strategic planning

Answer 36

c. To effectively manage risks in different areas

Question 37

Can one person perform risk assessments that cover only a specific area or department of the organization?

Answer 37

Yes
Performing risk assessments for a specific area or department of the organization by one person is often feasible due to the relatively focused scope and limited complexity associated with such assessments

Question 38

Who are considered interested parties (key players) in the context of risk assessments?

a. Only team members
b. External consultants
c. Only top management
d. Individuals or groups affected by the assessment outcomes

Answer 38

d. Individuals or groups affected by the assessment outcomes

Question 39

ISO/IEC 27005, clause 3.2.3 Risk assessment

Answer 39

Overall process of risk identification, risk analysis and risk evaluation

Question 40

A risk manager should be appointed to ensure proper coordination of risk management by:

Answer 40

• Planning activities,
• Supervising the risk management team
• Drafting risk assessment report
• Managing communication and awareness of risk with interested parties
• Follow up on the implementation of recommendations

Question 42

What are the core elements of the risk management process defined by ISO 31000 and ISO/IEC 27005 are:

Answer 42

Establishing the context
Risk assessment (comprising risk identification, risk analysis, and risk evaluation)
Risk treatment
Monitoring and review
Communication and consultation

Question 43

What should top management and oversight bodies demonstrate to convey their commitment to risk management according to ISO 27005?

Answer 43

They should demonstrate and articulate their continual commitment through a policy, a statement, or other forms that clearly convey the organization’s objectives and commitment to risk management.

Question 44

According to ISO 27005, how should risk assessment and risk management be updated, and into what cycles can updates be divided?

Answer 44

They should be updated on a regular basis and based on changes. Updates can be divided into two cycles: strategic cycles and operational cycles.

Question 45

How does the timing differ between the strategic and operational cycles in ISO 27005 risk management?

Answer 45

The strategic cycle is conducted at longer intervals or when major changes occur, while the operational cycle is shorter and depends on detailed risks identified and assessed, as well as related risk treatment.

Question 46

What is the primary focus of the strategic cycle compared to the operational cycle in ISO 27005 risk management?

Answer 46

The strategic cycle applies to the environment where the organization aims to achieve its objectives, while the operational cycle applies to all risk assessments within the context of the risk management process.