CGEIT Question 90

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The status of key risk indicators (KRIs) provides a concise and meaningful way to communicate the current state of cybersecurity risk. KRIs are specific metrics or indicators that are closely aligned with the organization's critical risks and objectives. Regular reporting on the status of key risk indicators allows the executive steering committee to monitor and assess the effectiveness of cybersecurity measures, identify emerging threats, and gauge the overall risk posture of the hospital's patient data systems.

• 1

  While the status of key risk indicators (option A), current business impact levels (option B), and IT operations gap assessment (option C) are important aspects of cybersecurity risk management, cybersecurity risk benchmarks provide a broader perspective and external validation of the hospital's cybersecurity efforts, making them particularly valuable for the executive steering committee's oversight responsibilities.

• 2

  It should be D - Including cybersecurity risk benchmarks in the report would be most helpful to the executive steering committee. Cybersecurity risk benchmarks provide a comparison of the hospital's security posture against industry best practices and standards. This information will help the committee understand how their cybersecurity practices compare to other organizations in the industry and identify potential areas of improvement. While status of key risk indicators, current business impact levels, and IT operations gap assessment are all important considerations, they do not provide the same level of insight into the hospital's cybersecurity practices compared to industry best practices. Therefore, including cybersecurity risk benchmarks in the report would be the most helpful to the committee in providing better oversight of cyber-related risks to the hospital.