CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentHard
A multinational corporation is developing a detailed risk scenario for a 'Supply Chain Cyber-Attack that Disrupts Global Operations'. To make this scenario actionable and useful for risk response planning, which of the following elements is MOST crucial to include beyond just the threat and impact?
- AThe exact financial value of all assets in the supply chain.
- BPotential controls and response actions to mitigate the disruption.
- CA comprehensive list of all potential suppliers.
- DSpecific indicators of compromise (IOCs) for the attack.
Show answer & explanationAnswer & explanation
Correct answer: B. Potential controls and response actions to mitigate the disruption.
While identifying threats and impacts is fundamental, for a risk scenario to be truly 'actionable and useful for risk response planning,' it must guide the organization on what to do. Therefore, outlining potential controls and response actions is critical to translate the identified risk into practical management strategies.
Why the other options are wrong
- A. The exact financial value of assets is part of quantitative impact analysis, but the emphasis is on 'actionable and useful for risk response planning,' which requires response strategies.
- C. A comprehensive list of suppliers is part of asset/scope definition, but not the most crucial element for making a scenario actionable for response.
- D. Specific IOCs are important for threat detection but are too granular for the overall scenario narrative aimed at strategic response planning.
Actionable Risk Scenarios
Risk scenarios that are detailed enough to inform specific risk treatment plans and guide decision-making for risk response.
- Go beyond mere identification of threat and impact.
- Include triggers, vulnerabilities, and potential response options.
- Facilitate practical planning and resource allocation.
Memory trick: An actionable scenario isn't just a story; it's a 'choose your own adventure' with solutions.