Isaca Updated CRISC Exam Questions and Answers by tymoteusz

 According to the CRISC Review Manual1, single sign-on (SSO) is a method of authentication that allows a user to access multiple systems or applications with a single set of credentials. SSO can improve user convenience and productivity, but it also introduces some security risks. The greatest concern as a result of a single sign-on implementation is that unauthorized access may be gained to multiple systems, as this can compromise the confidentiality, integrity, and availability of the data and resources stored on those systems. If an attacker obtains the SSO credentials of a user, either by phishing, malware, or other means, they can Laccess all the systems or applications that the user is authorized for, without any additional authentication or verification. This can expose the organization to various threats, such as data leakage, theft, loss, corruption, manipulation, or misuse2345. References = CRISC Review Manual1, page 240, 253.

 A review of a third-party vendor is a process that involves examining and evaluating the performance, quality, and compliance of the vendor that provides a product or service to the organization1. A review of a third-party vendor can help to identify and address the risks and issues that may arise from the vendor relationship, such as data breaches, service disruptions, contract violations, or reputation damage2. Following a review of a third-party vendor, it is most important for an organization to ensure that the results of the review are accurately reported to management, as this will enable the management to make informed and timely decisions and actions based on the findings and recommendations of the review. Accurate reporting of the results of the review will also help to establish and maintain the trust and transparency between the organization and the vendor, and to demonstrate the accountability and responsibility of the organization for its vendor risk management3. Identified findings are reviewed by the organization, results of the review are validated by internal audit, and identified findings are approved by the vendor are not the most important things to ensure following a review of a third-party vendor, as they do not provide the same level of impact and value as accurate reporting of the results of the review. Identified findings are reviewed by the organization is a process that involves analyzing and interpreting the outcomes and implications of the review of a third-party vendor, and determining the appropriate risk responses and actions to address the findings4. This is an important step in the vendor risk management process, but it is not the most important thing to ensure following a review of a third-party vendor, as it does not communicate or inform the management or the vendor of the results of the review. Results of the review are validated by internal audit is a process that involves verifying and confirming the accuracy and reliability of the review of a third-party vendor, and providing assurance and advice on the adequacy and effectiveness of the vendor risk management. This is an important step in the vendor risk management process, but it is not the most important thing to ensure following a review of a third-party vendor, as it does not report or share the results of the review with the management or the vendor. Identified findings are approved by the vendor is a process that involves obtaining the consent and agreement of the vendor on the outcomes and recommendations of the review of a third-party vendor, and ensuring their cooperation and compliance with the risk responses and actions. This is an important step in the vendor risk management process, but it is not the most important thing to ensure following a review of a third-party vendor, as it does not report or inform the management of the results of the review. References = 1: The guide to third-party vendor reviews - TerraTrue HQ | TerraTrue2: 4 Tips For Organizations To Evaluate Third-Party Vendors – Forbes Advisor3: Vendor Risk Management: Best Practices for 2023 - Venminder4: [Risk and Information Systems Control Study Manual, Chapter 3: Risk Response, Section 3.1: Risk Response Options, pp. 113-115.] : [IT Risk Resources | ISACA] : Who Is Considered a Third Party or Vendor? - Venminder : [Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Assessment, Section 2.1: Risk Identification, pp. 57-59.] : [Risk and Information Systems Control Study Manual, Chapter 4: Risk and Control Monitoring and Reporting, Section 4.2: Risk Monitoring, pp. 189-191.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.1: Control Design, pp. 233-235.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.2: Control Implementation, pp. 243-245.] : [Risk and Information Systems Control Study Manual, Chapter 5: Information Systems Control Design and Implementation, Section 5.3: Control Monitoring and Maintenance, pp. 251-253.]

Mitigating technology risk to acceptable levels means that the organization implements and maintains appropriate controls to reduce the likelihood and impact of potential threats or losses that may arise from the use of technology, such as IT systems, applications, networks, devices, etc.

The primary factor that should guide the mitigation of technology risk is the organizational risk appetite. This means that the organization defines and communicates the amount and type of risk that it is willing to accept or pursue in order to achieve its objectives and strategy.

The organizational risk appetite helps to determine the risk tolerance and thresholds for different risk categories and scenarios, prioritize the risks, select the most suitable risk responses, allocate the resources and budget for risk management, and monitor and report the risk performance and outcomes.

The other options are not the primary factors that should guide the mitigation of technology risk. They are either secondary or not essential for risk management.

The references for this answer are:

Risk IT Framework, page 25

Information Technology & Security, page 19

Risk Scenarios Starter Pack, page 17

The most important thing for a risk practitioner to ensure once a risk action plan has been completed is that the risk owner has validated the outcomes, as this means that the risk owner has confirmed that the risk response has been implemented and that the risk level has been reduced to an acceptable level. The risk owner is the person or entity with the authority and responsibility to manage a particular risk, and they should evaluate the effectiveness and efficiency of the risk action plan, and report any issues or changes. The risk action plan is a document that outlines the specific actions, resources, responsibilities, and timelines for implementing a risk response. The other options are not the most important things for a risk practitioner to ensure once a risk action plan has been completed, although they may be useful or necessary steps. Updating the risk register is a good practice, but it should be done after the risk owner has validated the outcomes and with the consent of the risk owner. Mapping the control objectives to the risk objectives is a part of the risk response design, but it does not measure the actual achievement of the risk objectives. Achieving the requirements is a desired result, but it does not guarantee that the risk owner has validated the outcomes or that the risk level has been reduced to an acceptable level. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 146.