Review questions

1. Which of the following is the first step in IT risk management?
   1. IT risk assessment
   2. Risk response and mitigation
   3. IT risk identification
   4. Risk reporting
2. Oversight and direction are the responsibility of who?
   1. Management
   2. Senior staff
   3. IT risk manager
   4. Board of directors
3. The high-level intent of an organization’s security practices is best established by which of the following?
   1. Procedures
   2. Policies
   3. Guidelines
   4. Processes
4. Which of the following groups should be reached out to for expert guidance on the working group?
   1. Responsible
   2. Accountable
   3. Consulted
   4. Informed
5. An IT risk manager recently joined an organization that had quite a few security incidents in the past. Which of the following should be the primary focus of the IT risk manager in the first few months of their tenure to reduce similar incidents in the future?
   1. Cite individuals who caused the incidents
   2. Understand the organization’s culture toward risk
   3. Draft the strategy for IT risk management
   4. Complete all the...