CRISC Certified in Risk and Information Systems ControlGovernanceMedium
An organization is undergoing a significant digital transformation initiative that involves adopting new cloud technologies and agile development methodologies. The board of directors has expressed concerns about integrating risk management practices effectively into these fast-paced and evolving environments. Which of the following approaches is BEST suited to address the board's concerns?
- AEmbed risk management activities directly into the continuous integration/continuous delivery (CI/CD) pipelines and agile sprints.
- BConduct quarterly risk assessments for all digital transformation projects.
- CMandate that all project managers complete advanced risk management certification.
- DDevelop a separate, dedicated risk management team for cloud and agile projects.
Show answer & explanationAnswer & explanation
Correct answer: A. Embed risk management activities directly into the continuous integration/continuous delivery (CI/CD) pipelines and agile sprints.
Embedding risk management directly into CI/CD pipelines and agile sprints ensures that risk is considered continuously and proactively as part of the development lifecycle, aligning with the fast-paced nature of digital transformation.
Why the other options are wrong
- B. Quarterly assessments are too infrequent for fast-paced digital transformation projects, leading to delayed identification of emerging risks.
- C. While beneficial, certification alone doesn't guarantee effective integration into the operational workflows of cloud and agile environments.
- D. A separate team can create silos, hindering integration into fast-paced environments.
Risk Integration in Agile/DevOps
The practice of embedding risk identification, assessment, and mitigation directly into the iterative and continuous processes of agile development and DevOps pipelines, ensuring that risk is managed proactively and continuously throughout the software development lifecycle.
- Shifts risk left (earlier in the lifecycle).
- Enables continuous feedback and adaptation.
- Aligns with the speed and flexibility of modern development.
Memory trick: For fast-paced change, risk must be baked in, not bolted on.