CRISC Certified in Risk and Information Systems ControlGovernanceEasy
A project manager is overseeing the development of a new critical customer-facing application. During a risk assessment, a significant potential vulnerability is identified in a third-party component that could lead to a data breach. The project manager's MOST appropriate immediate action, from a governance perspective, is to:
- AInstruct the development team to try to patch the third-party component without informing the vendor.
- BImmediately replace the third-party component with an internally developed one, regardless of cost or schedule impact.
- CDocument the vulnerability, inform the project sponsor and relevant stakeholders, and propose a mitigation plan.
- DIgnore the vulnerability, assuming the third-party vendor will eventually fix it in a future update.
Show answer & explanationAnswer & explanation
Correct answer: C. Document the vulnerability, inform the project sponsor and relevant stakeholders, and propose a mitigation plan.
From a governance perspective, transparency and proper communication of risks to stakeholders are paramount. Documenting the issue and proposing a plan allows for informed decision-making by those responsible.
Why the other options are wrong
- A. Attempting to patch a third-party component without vendor knowledge can void warranties, introduce instability, and potentially create new vulnerabilities.
- B. Immediate replacement without proper assessment and stakeholder consultation may be an overreaction and could introduce new risks or delays.
- D. Ignoring a known significant vulnerability is a severe dereliction of duty and exposes the organization to unacceptable risk.
Risk Escalation & Communication
The process of formally documenting a significant identified risk and communicating it to relevant stakeholders, including project sponsors and governance bodies, along with proposed response options.
- Ensures transparency and informed decision-making.
- Critical for project and organizational governance.
- Facilitates appropriate resource allocation for risk response.
Memory trick: Find a risk? Document, tell, and plan, then let the leaders command.