CRISC Question 280

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  A. Aggregate risk approaching the tolerance threshold When risk owners frequently approve exceptions to the information security policy, it implies that multiple risks are being accepted. The accumulation of all these accepted risks can lead to an aggregate risk level that approaches or even exceeds the organization's risk tolerance threshold. This aggregate risk can be higher than what the organization can manage or absorb, potentially leading to serious consequences.

• Chose B1

  B. Vulnerabilities are not being mitigated. The risk practitioner's greatest concern should be that vulnerabilities are not being mitigated despite the high number of exceptions to the information security policy. Approving a high number of exceptions can indicate that security controls and policies are being bypassed, potentially leaving vulnerabilities unaddressed. This could lead to a situation where the organization's systems and data are exposed to risks that could have been prevented or minimized through proper adherence to security policies.

• Chose A1

  A: approving exceptions means they are accepting risks. Owners don't cause an exception to security policies without the buy in from security. too many approvals increases risk in the aggregate.