CRISC Question 333

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  Answer is C. A - Policies set guidelines, but they don’t always translate directly into real-world risk scenarios.

• Chose B1

  B. Derive scenarios from IT risk policies and standards. The best approach to creating a comprehensive set of IT risk scenarios is to "B. Derive scenarios from IT risk policies and standards." IT risk policies and standards provide a structured framework for identifying and addressing risks that are specific to the organization's IT environment. Deriving scenarios from these policies ensures that the scenarios are relevant, aligned with the organization's goals, and based on recognized best practices. While the other options (gathering scenarios from senior management, benchmarking against industry peers, mapping scenarios to a recognized risk management framework) can provide valuable input, deriving scenarios from IT risk policies and standards directly ties the risk scenarios to the organization's specific IT risk management framework and ensures that they address the unique challenges and requirements of the organization's IT environment.

• Chose D1

  Agree "D" referring to ISO 31000 or similar is better (even that some domains of the framework are not applicable in the organization) but the framework is globally recognized for all industries and comprehensive. Organization P&P could be a good option BUT mostly not updated with new threats assuming they were prepared originally by the risk experts