You're reading from ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

Product type Book

Published in Sep 2023

Publisher Packt

ISBN-13 9781803236902

Pages 316 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Shobhit Mehta

Table of Contents (28) Chapters

Preface

1. Part 1: Governance, Risk, and Compliance and CRISC

2. Chapter 1: Governance, Risk, and Compliance

3. Chapter 2: CRISC Practice Areas and the ISACA Mindset

4. Part 2: Organizational Governance, Three Lines of Defense, and Ethical Risk Management

5. Chapter 3: Organizational Governance, Policies, and Risk Management

6. Chapter 4: The Three Lines of Defense and Cybersecurity

7. Chapter 5: Legal Requirements and the Ethics of Risk Management

8. Part 3: IT Risk Assessment, Threat Management, and Risk Analysis

9. Chapter 6: Risk Management Life Cycle

10. Chapter 7: Threat, Vulnerability, and Risk

11. Chapter 8: Risk Assessment Concepts, Standards, and Frameworks

12. Chapter 9: Business Impact Analysis, and Inherent and Residual Risk

13. Part 4: Risk Response, Reporting, Monitoring, and Ownership

14. Chapter 10: Risk Response and Control Ownership

15. Chapter 11: Third-Party Risk Management

16. Chapter 12: Control Design and Implementation

17. Chapter 13: Log Aggregation, Risk and Control Monitoring, and Reporting

18. Part 5: Information Technology, Security, and Privacy

19. Chapter 14: Enterprise Architecture and Information Technology

20. Chapter 15: Enterprise Resiliency and Data Life Cycle Management

21. Chapter 16: The System Development Life Cycle and Emerging Technologies

22. Chapter 17: Information Security and Privacy Principles

23. Part 6: Practice Quizzes

24. Chapter 18: Practice Quiz – Part 1

25. Chapter 19: Practice Quiz – Part 2

26. Index

Why subscribe?

27. Other Books You May Enjoy

Critical concepts for risk assessment and management

This section is the essence of the critical concepts that will be widely used across this book, your day-to-day job, and any ISACA exam including the CRISC.

The risk profile

The purpose of the risk management function is to optimize the risk decisions for an enterprise. The risk profile is the overall risk exposure of the organization to any type of risk. There are many factors that could impact the risk profile of an organization, such as new regulations, changes in the underlying technology, changes in the business objectives, mergers and acquisitions, direct or indirect competitors, and more. This is all part of the enterprise risk profile and will impact all businesses and functions of the organization.

The IT risk profile of an organization is the overall identified IT risk to which the enterprise is exposed. Similar to the enterprise risk profile, the IT risk profile can be dependent on many external factors such as...