I85PREP
⌘ K
BCS CISMP study materials
BCS CISMP study resources

BCS CISMP practice questions

One question at a time. Build your BCS CISMP understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information security management principles

Which term describes the principle that a user should be given only the minimum access rights needed to perform their job?

  1. Separation of duties
  2. Defence in depth
  3. Least privilege Correct answer.
  4. Need-to-know

Explanation

Least privilege means granting each account only the access necessary for its defined tasks, and nothing extra. It limits the damage an accidental error or compromised account can cause, because the account cannot reach resources beyond its remit.

Question 2Information security management principles

In information security, what does the term 'asset' refer to?

  1. Any item that has value to the organisation and therefore requires protection Correct answer.
  2. A software tool used to monitor network traffic
  3. A documented procedure for handling incidents
  4. A person who is authorised to audit the security management system

Explanation

An asset is anything of value to the organisation, including information, systems, people, premises and reputation. Asset identification underpins risk assessment because risks are only meaningful in relation to something worth protecting.

Question 3Information security management principles

Which security property is directly compromised when an attacker alters the value of a payment instruction in transit?

  1. Integrity Correct answer.
  2. Authentication
  3. Availability
  4. Non-repudiation

Explanation

Integrity is the property that data remains accurate and complete and has not been changed without authorisation. Altering a payment amount in transit is a direct violation of integrity, even if the message still arrives.

Question 4Information security management principles

What is the primary purpose of an information security policy?

  1. To state management's direction and requirements for protecting information across the organisation Correct answer.
  2. To record the technical configuration settings of each server
  3. To provide a step-by-step guide for installing security patches
  4. To list the individual firewall rules applied at the network perimeter

Explanation

A policy is a high-level statement of management intent that sets mandatory direction and requirements. It provides the authority and framework from which standards, procedures and guidelines are derived.

Question 5Information security management principles

Which statement best distinguishes a threat from a vulnerability?

  1. A threat is a weakness in a system, while a vulnerability is the person who exploits it
  2. A threat is a measured level of loss, while a vulnerability is the likelihood of that loss occurring
  3. A threat is a potential cause of harm, while a vulnerability is a weakness that the threat could exploit Correct answer.
  4. A threat is a control that has failed, while a vulnerability is a control that is missing

Explanation

A threat is anything with the potential to cause harm, such as an attacker, malware or a flood. A vulnerability is a weakness in an asset or control that a threat could act upon to cause an incident.

Question 6Information security management principles

An organisation decides to buy insurance to cover the financial impact of a data breach. Which risk treatment option is this?

  1. Risk avoidance
  2. Risk transfer Correct answer.
  3. Risk reduction
  4. Risk acceptance

Explanation

Transferring risk means shifting the financial consequence to a third party, typically through insurance or contractual arrangements. The risk itself still exists, but the organisation is no longer bearing the full cost.

Question 7Information security management principles

Which of the following is an example of a physical security control?

  1. A firewall rule blocking inbound traffic
  2. A locked door with an access card reader Correct answer.
  3. An encryption algorithm protecting data at rest
  4. A password complexity standard

Explanation

Physical controls restrict access to premises, equipment and media through barriers, locks and entry systems. A card-controlled door acts on the physical environment rather than on data or network traffic.

Question 8Information security management principles

What does the principle of separation of duties aim to prevent?

  1. A single person being able to complete a sensitive transaction without detection or challenge Correct answer.
  2. Employees sharing their passwords with colleagues
  3. Loss of data caused by a hardware failure
  4. Unauthorised devices connecting to the corporate network

Explanation

Separation of duties divides a sensitive process among different people so that no individual holds end-to-end control. This makes fraud or serious error harder to commit without collusion or being noticed.

Question 9Information security management principles

A company classifies documents so staff know which handling rules apply. Which factor should most directly determine the classification level assigned?

  1. The length of the document and the number of pages
  2. The file format in which the document is stored
  3. The sensitivity of the information and the harm that disclosure would cause Correct answer.
  4. The department that produced the document

Explanation

Classification should reflect the value and sensitivity of the information and the impact of its compromise. Handling rules follow from that assessed harm, not from incidental attributes of the file.

Question 10Information security management principles

Which statement best describes the role of an Information Asset Owner?

  1. They make decisions about how a defined asset is classified, used and protected Correct answer.
  2. They approve the organisation's overall risk appetite statement
  3. They conduct independent audits of the security management system
  4. They configure and maintain the technical controls protecting the asset

Explanation

An asset owner is accountable for a specific asset and decides its classification, permitted use and required protection. Custodians then implement and operate the controls the owner requires.

Question 11Information security management principles

Why is a business impact analysis important when developing business continuity arrangements?

  1. It proves that all technical controls are correctly configured
  2. It identifies critical activities and the consequences of their disruption over time Correct answer.
  3. It replaces the need for a formal risk assessment
  4. It determines the disciplinary process for security breaches

Explanation

A business impact analysis establishes which activities are critical and how the impact of disruption grows over time. Its outputs, such as recovery time objectives, drive the design of continuity and recovery arrangements.

Question 12Information security management principles

Which of the following best describes an acceptable use policy?

  1. It specifies the cryptographic algorithms approved for protecting stored data
  2. It sets out the penalties for competitors who misuse trademarks
  3. It records the recovery time objectives for each critical system
  4. It defines how staff may use organisational information systems and the behaviour expected of them Correct answer.

Explanation

An acceptable use policy sets expectations for how users may employ organisational systems and information. It typically covers permitted activities, prohibitions and the consequences of misuse.

Question 13Information security management principles

An organisation holds personal data and must comply with data protection law. Which principle requires that data be kept no longer than necessary for its purpose?

  1. Data minimisation
  2. Storage limitation Correct answer.
  3. Integrity and confidentiality
  4. Lawfulness and fairness

Explanation

Storage limitation requires that personal data be retained only as long as needed for the stated purpose. It is supported by retention schedules and secure disposal arrangements.

Question 14Information security management principles

In risk assessment, what does the term 'risk appetite' describe?

  1. The amount and type of risk an organisation is willing to pursue or retain Correct answer.
  2. The maximum financial loss a single incident could cause
  3. The speed at which a risk is expected to materialise
  4. The total number of risks recorded in the risk register

Explanation

Risk appetite expresses how much risk the organisation is prepared to accept in pursuit of its objectives. It guides decisions on which risks need treatment and how much control is proportionate.

Question 15Information security management principles

An organisation decides to stop offering a legacy online service because it cannot be adequately secured. Which risk treatment has been applied?

  1. Risk reduction
  2. Risk acceptance
  3. Risk avoidance Correct answer.
  4. Risk transfer

Explanation

Avoidance removes the risk by eliminating the activity that gives rise to it. Withdrawing the insecure service means the associated exposure no longer exists in that form.

Question 16Information security management principles

Why should security awareness training be repeated at regular intervals rather than delivered once at induction?

  1. Because repetition allows the training budget to be spent fully
  2. Because legislation requires training to be delivered only to new starters
  3. Because a single session cannot legally count as valid training
  4. Because people forget and because threats and policies change over time Correct answer.

Explanation

Awareness decays over time and the threat landscape, technology and policies change, so refresher training keeps knowledge current. Regular delivery also reinforces a security-conscious culture.

Question 17Information security management principles

Which document type typically describes the detailed steps a technician must follow to restore a server from backup?

  1. A procedure Correct answer.
  2. A guideline
  3. A policy
  4. A standard

Explanation

A procedure gives step-by-step instructions for carrying out a specific task, such as restoring from backup. Policies set direction, standards set mandatory requirements, and guidelines offer advice.

Question 18Information security management principles

A risk has been assessed as low likelihood but very high impact. Which statement about its treatment is most appropriate?

  1. It should be removed from the risk register until likelihood increases
  2. It must always be transferred to an insurer regardless of cost
  3. Controls that reduce the impact or provide contingency should be considered even though occurrence is unlikely Correct answer.
  4. The risk can be ignored because low likelihood means it will not happen

Explanation

Risk combines likelihood and impact, so a rare event with severe consequences can still warrant treatment. Impact-reducing or contingency controls address the seriousness of the outcome rather than the chance of it occurring.

Question 19Information security management principles

What is the main purpose of a formal change management process in security terms?

  1. To ensure that all changes are made by the most senior engineer available
  2. To record the hours each engineer spends on maintenance tasks
  3. To prevent any change being made to production systems
  4. To assess the security impact of changes before they are implemented and to keep systems in a known state Correct answer.

Explanation

Change management evaluates proposed changes for risk and security impact before approval and records what was altered. This keeps systems in a controlled, known state and reduces the chance of introducing weaknesses.

Question 20Information security management principles

An employee receives an email that appears to come from the finance director asking for an urgent payment to a new supplier. Which control is most directly designed to counter this type of fraud?

  1. Regular vulnerability scanning of the email server
  2. Encryption of the finance department's file shares
  3. A documented verification process for payment requests using an independent contact route Correct answer.
  4. A stronger password policy for email accounts

Explanation

This is a social engineering attempt exploiting authority and urgency, so the effective defence is a process that verifies requests through an independent channel. Technical email controls help but cannot replace a procedural check before money moves.

Question 21Information security management principles

Which statement best explains why security responsibilities should be defined in job descriptions and contracts?

  1. It transfers all liability for breaches to individual employees
  2. It makes security obligations enforceable and ensures staff understand their accountability Correct answer.
  3. It allows the organisation to reduce its insurance premiums automatically
  4. It removes the need for any technical security controls

Explanation

Embedding security duties in job descriptions and contracts creates clear accountability and gives the organisation a basis for enforcement. It also signals to staff that security is part of their role rather than an optional extra.

Question 22Information security management principles

An organisation uses a risk matrix with likelihood and impact axes. Two risks both score as high. Why might they still require different treatment decisions?

  1. Because high-scoring risks are automatically transferred to a third party
  2. Because a risk matrix always produces identical treatment for identical scores
  3. Because likelihood and impact cannot both be assessed for the same risk
  4. Because the cost and practicality of controls, and the organisation's tolerance, may differ between them Correct answer.

Explanation

A matrix score summarises risk but treatment also depends on the cost and feasibility of controls and on risk tolerance. Two risks with the same score can therefore justify different decisions.

Question 23Information security management principles

An organisation outsources payroll to a supplier. Which arrangement best reflects sound security governance of this relationship?

  1. Transferring all responsibility for payroll data to the supplier with no oversight
  2. Defining security requirements in the contract and monitoring the supplier's compliance against them Correct answer.
  3. Assuming the supplier applies the same controls as the organisation without verification
  4. Relying on the supplier's own marketing claims about security

Explanation

Accountability for outsourced data generally remains with the organisation, so requirements must be contractual and verified. Monitoring provides evidence that the supplier continues to meet those obligations.

Question 24Information security management principles

A security manager wants to demonstrate that a control operates effectively throughout the year, not just at a point in time. Which approach is most appropriate?

  1. Collecting continuous or regularly sampled evidence of the control's operation, such as logs and review records Correct answer.
  2. Relying on the design documentation produced when the control was introduced
  3. Asking staff informally whether they believe the control works
  4. Obtaining a single signed statement from the control owner at year end

Explanation

Operating effectiveness requires evidence that the control actually functioned over the period under review. Continuous or sampled records such as logs and completed reviews provide that evidence.

Question 25Information security management principles

Why is it important that security metrics be linked to business objectives rather than counting activity alone?

  1. Because activity counts are always inaccurate and should never be collected
  2. Because metrics linked to objectives remove the need for internal audit
  3. Because business objectives are the only thing senior management is allowed to discuss
  4. Because metrics tied to objectives show whether security is reducing risk in ways that matter to the organisation Correct answer.

Explanation

Metrics aligned with business objectives demonstrate the value of security in terms decision-makers understand, such as reduced incidents or faster recovery. Pure activity counts show effort but not whether risk is being reduced.

Question 26Information security management principles

Which statement best describes the relationship between an information security policy and the standards, procedures and guidelines that sit beneath it?

  1. The policy sets mandatory high-level direction, while standards, procedures and guidelines provide increasingly detailed means of meeting it Correct answer.
  2. The policy is optional guidance, while standards and procedures are the only documents that staff are required to follow
  3. The policy describes technical configurations, while standards and procedures describe the disciplinary process for breaches
  4. The policy and the procedures beneath it are interchangeable documents that may be issued in any order the organisation prefers

Explanation

A policy states management's mandatory intent and direction at a high level, and the supporting documents translate that intent into specific requirements, step-by-step instructions and advice. Each layer becomes more detailed and more changeable, so technical detail belongs in standards and procedures rather than in the policy itself. This hierarchy keeps the policy stable while allowing lower documents to evolve with technology.

Question 27Information security management principles

An organisation wants a single, internationally recognised reference of good practice for establishing, implementing, maintaining and continually improving its information security management system. Which source is most appropriate?

  1. ISO 9001
  2. ISO/IEC 27001 Correct answer.
  3. The OECD privacy guidelines
  4. A vendor's product hardening guide

Explanation

ISO/IEC 27001 is the international standard that specifies requirements for an information security management system, including the continual improvement cycle. It provides a certifiable framework covering governance, risk treatment and control selection. The other options address quality management, privacy principles or specific products rather than a general ISMS.

Question 28Information security management principles

Which statement best captures the principle of least privilege?

  1. Users are granted only the access rights needed to perform their current duties, for only as long as those duties require Correct answer.
  2. Users are granted broad access on appointment so that they can cover for absent colleagues without delay
  3. Users may retain access from previous roles provided they have signed an acceptable use policy
  4. Access rights are granted to the group with the largest membership so that administration is simplified

Explanation

Least privilege limits each identity to the minimum access necessary for the tasks actually being performed, and for the minimum period. This reduces the damage that an accidental error, a compromised account or a malicious insider can cause. Access should be reviewed and removed when the underlying need disappears.

Question 29Information security management principles

Why does information classification depend on an assessment of the harm that would result from disclosure, modification or loss?

  1. Because the classification label determines the salary band of the employee who created the document
  2. Because classification is primarily a record-keeping exercise used to count how many documents each department holds
  3. Because regulators require every organisation to use exactly five classification levels regardless of its sector
  4. Because the handling rules and protective measures applied to an asset should be proportionate to the impact of its compromise Correct answer.

Explanation

Classification exists to drive proportionate protection: the greater the potential harm from compromise, the stronger the handling, storage and sharing controls required. Assessing impact first ensures labels are meaningful and consistent rather than arbitrary. The scheme should reflect the organisation's own risk environment, not a fixed number of levels.

Question 30Information security management principles

A new starter is given system access before their employment references and right-to-work checks have been completed. Which control weakness does this most directly illustrate?

  1. Inadequate pre-employment screening within the joiners process Correct answer.
  2. Insufficient network segmentation between user groups
  3. Failure to apply cryptographic controls to stored data
  4. Absence of a formal change advisory board

Explanation

Screening and verification are part of the joiners, movers and leavers lifecycle, and should be completed before access is granted. Granting access first bypasses the control designed to confirm that the person is suitable and entitled to the role. The other options concern architecture or change control rather than personnel onboarding.

Question 31Information security management principles

During a risk assessment a team records a risk with a known vulnerability, no existing control and a credible threat source. Which combination of factors are they assessing?

  1. Likelihood of the threat exploiting the vulnerability and the impact if it does Correct answer.
  2. The classification of the asset and the length of the retention period
  3. The audit findings from last year and the number of open incidents
  4. The cost of the control and the seniority of the risk owner

Explanation

Risk is assessed by combining the probability that a threat will exploit a vulnerability with the consequence to the organisation if that happens. Existing controls modify both factors, so their absence raises the assessed level. Cost, ownership and audit history inform treatment decisions but are not the two axes of the risk itself.

Question 32Information security management principles

An organisation must choose between two controls for the same risk. Which approach best supports a defensible decision?

  1. Choose the cheaper control because cost is the only objective factor available
  2. Select whichever control the largest supplier recommends in its marketing material
  3. Defer the decision until the next external audit identifies a finding
  4. Compare the reduction in assessed risk against the total cost of ownership of each control over its lifecycle Correct answer.

Explanation

A cost-benefit comparison should weigh the risk reduction achieved against the full cost of acquiring, operating and maintaining each control. This keeps spending proportionate to the risk and provides an auditable rationale. Deferring the decision leaves the risk untreated in the meantime.

Question 33Information security management principles

What is the primary purpose of an asset inventory in an information security management system?

  1. To identify what information and supporting assets exist so that appropriate ownership and protection can be assigned Correct answer.
  2. To provide a list of equipment for the finance department's depreciation calculations
  3. To record every employee's training completion dates
  4. To document the minutes of management review meetings

Explanation

You cannot protect what you have not identified, so an inventory records information assets and the systems that support them. Each entry can then be assigned an owner and given protection proportionate to its classification. Financial depreciation and training records are separate administrative processes.

Question 34Information security management principles

A manager asks why the organisation should maintain a register of legal, regulatory and contractual security requirements. Which answer is most accurate?

  1. It provides a basis for confirming that controls meet obligatory requirements and for evidencing compliance when challenged Correct answer.
  2. It replaces the need for a risk assessment because legal duties cover all realistic threats
  3. It guarantees that no breach of contract will ever occur with a supplier
  4. It allows the organisation to avoid documenting its own internal policies

Explanation

A compliance register maps each obligation to the controls and evidence that satisfy it, which supports monitoring and demonstrates due diligence. Legal and contractual duties are inputs to the risk and control environment, not a substitute for it. Internal policies remain necessary to interpret obligations in the organisation's context.

Question 35Information security management principles

An organisation wants assurance that a supplier's security controls remain effective between annual contract reviews. Which mechanism is most appropriate?

  1. Agreeing a right to audit or to receive independent assurance reports at defined intervals Correct answer.
  2. Requesting a copy of the supplier's marketing brochure once at the start of the contract
  3. Assuming the controls are effective because the contract was signed by a senior manager
  4. Relying on the supplier's public website statements about security

Explanation

Ongoing assurance requires a contractual right to verify controls, whether through audit, certification evidence or independent reports such as assurance statements. This gives the customer visibility of control effectiveness over time. Public statements and brochures are not reliable evidence of operational effectiveness.

Question 36Information security management principles

Which statement best explains why incident management should include a documented escalation path with defined timeframes?

  1. It ensures serious incidents reach people with authority to act quickly and consistently at any hour Correct answer.
  2. It removes the need to record incidents once they have been escalated
  3. It allows the service desk to close incidents without technical investigation
  4. It guarantees that the root cause of every incident will be identified

Explanation

Escalation paths and timeframes ensure that incidents are routed to the right authority promptly, including out of hours, so decisions about containment and communication are not delayed. They also make response consistent and auditable. Recording, root cause analysis and investigation remain separate necessary activities.

Question 37Information security management principles

A department stores backup tapes in an unlocked cabinet in a shared corridor. Which single change most directly addresses the confidentiality risk?

  1. Increasing the frequency of the backup schedule
  2. Relocating the tapes to a locked, access-controlled store and logging who retrieves them Correct answer.
  3. Compressing the backups to reduce the number of tapes
  4. Adding a second copy of the tapes in the same corridor

Explanation

The weakness is unauthorised physical access to media, so the direct remedy is a controlled location with access logging. Backup frequency affects availability and recovery objectives, not who can take the tapes. Compression and duplicate copies do not prevent access by unauthorised people.

Question 38Information security management principles

An organisation allows staff to use personal devices for work email. Which governance arrangement best manages the resulting risk?

  1. A ban on discussing the arrangement with the security team
  2. A bring-your-own-device policy with minimum device requirements, defined support boundaries and remote wipe capability Correct answer.
  3. Relying on the devices' default settings because they were supplied by reputable manufacturers
  4. An informal understanding that staff will keep their devices reasonably up to date

Explanation

Personal devices extend the organisation's boundary, so a formal policy should set minimum security requirements, clarify what the organisation will and will not support, and provide a means to remove corporate data if a device is lost. This balances usability with protection of organisational information. Informal arrangements leave responsibilities undefined.

Question 39Information security management principles

Senior management asks how the security function demonstrates that its programme delivers value rather than simply consuming budget. Which approach is most convincing?

  1. Reporting the total number of emails blocked by the spam filter
  2. Reporting the headcount of the security team compared with last year
  3. Reporting the number of policy documents issued during the year
  4. Reporting outcome measures tied to business objectives, such as reduced incident impact and improved control coverage Correct answer.

Explanation

Metrics are persuasive when they show progress towards business objectives, such as reduced disruption, faster recovery or improved coverage of critical controls. Activity counts describe effort but not outcome, and can rise while risk remains unchanged. Linking measures to objectives also helps management prioritise investment.

Question 40Information security management principles

An organisation is deciding whether to accept a residual risk after controls have been applied. Which condition makes acceptance most defensible?

  1. The risk is accepted verbally by the person who discovered it during a technical test
  2. The risk is accepted because no budget remains in the current financial year
  3. The risk is accepted indefinitely without any further reference to management
  4. A named accountable owner formally accepts the residual level against documented criteria and reviews it periodically Correct answer.

Explanation

Defensible acceptance requires accountability at an appropriate level, a documented comparison against agreed risk criteria, and periodic review as the environment changes. This creates an auditable record that the decision was informed and authorised. Verbal or financially driven acceptance lacks both authority and evidence.

Question 41Information risk management

In information risk management, which term describes the probable frequency or magnitude of a loss resulting from a threat exploiting a vulnerability?

  1. Baseline
  2. Asset
  3. Risk Correct answer.
  4. Control

Explanation

Risk combines the likelihood of a threat event with its potential business impact, so it expresses probable loss rather than a single component. It is assessed by relating threats and vulnerabilities to the value of the assets affected.

Question 42Information risk management

A risk assessment estimates that a denial-of-service attack could cost GBP 200,000 and has an annual likelihood of 10 percent. What is the annualised loss expectancy?

  1. GBP 2,000
  2. GBP 2,000,000
  3. GBP 20,000 Correct answer.
  4. GBP 200,000

Explanation

Annualised loss expectancy equals single loss expectancy multiplied by annualised rate of occurrence. Here GBP 200,000 times 0.10 gives GBP 20,000 per year.

Question 43Information risk management

Which risk treatment option involves transferring risk to another party?

  1. Closing a service that carries the risk
  2. Applying additional access controls
  3. Accepting the risk with no action
  4. Purchasing cyber insurance Correct answer.

Explanation

Transfer shifts the financial consequence of a risk to a third party, commonly through insurance or contractual arrangements. The underlying risk still exists but its financial impact is borne elsewhere.

Question 44Information risk management

What is the primary purpose of defining risk appetite?

  1. To record every identified risk in a central register
  2. To calculate the exact financial value of each information asset
  3. To list the technical controls mandated for every system
  4. To state how much risk the organisation is willing to accept in pursuit of its objectives Correct answer.

Explanation

Risk appetite expresses the amount and type of risk an organisation is prepared to pursue or retain to meet its objectives. It guides treatment decisions and provides a benchmark for judging whether risk levels are acceptable.

Question 45Information risk management

Which statement describes residual risk?

  1. The total risk before any controls exist
  2. The risk that a control will fail to operate as designed
  3. The risk that a supplier will breach a contract
  4. The risk that remains after controls and treatment have been applied Correct answer.

Explanation

Residual risk is what remains once existing or planned controls have been taken into account. It should be compared with the risk tolerance to decide whether further treatment is required.

Question 46Information risk management

An organisation decides to stop offering an online service because the associated risk cannot be reduced to an acceptable level. Which risk treatment has been applied?

  1. Risk transfer
  2. Risk sharing
  3. Risk avoidance Correct answer.
  4. Risk acceptance

Explanation

Avoidance eliminates the risk by removing the activity that creates it. Here the service is discontinued, so the exposure arising from it no longer exists.

Question 47Information risk management

Which pairing correctly matches a risk analysis approach with its characteristic?

  1. Qualitative analysis assigns numeric monetary values to each loss event.
  2. Quantitative analysis relies solely on expert opinion without any numeric data.
  3. Qualitative analysis uses descriptive scales to rank risks by relative significance. Correct answer.
  4. Quantitative analysis ranks risks using descriptive scales such as high and medium.

Explanation

Qualitative analysis uses descriptive categories and judgement to rank risks, which is quick and useful for screening. Quantitative analysis instead uses numeric data to estimate frequency and financial impact.

Question 48Information risk management

Which factor most directly increases the likelihood component of an information risk?

  1. A larger marketing budget for the coming year
  2. A longer contractual notice period with a supplier
  3. A higher replacement cost for the affected hardware
  4. A widely known, unpatched vulnerability on an internet-facing server Correct answer.

Explanation

Likelihood reflects how probable it is that a threat will exploit a weakness. A publicly known, unpatched flaw on an exposed system raises the chance of successful exploitation.

Question 49Information risk management

What does a risk register primarily provide?

  1. A record of identified risks with owners, ratings and treatment status Correct answer.
  2. A schedule of planned software releases for the year
  3. A list of all employees who have access to the data centre
  4. A technical log of every security event detected on the network

Explanation

A risk register is the central record of identified risks, capturing details such as ownership, assessment results, treatment actions and current status. It supports monitoring and reporting of risk across the organisation.

Question 50Information risk management

An organisation applies the same set of mandatory controls to all systems regardless of their individual risk profile. Which approach does this describe?

  1. An acceptance approach
  2. A quantitative approach
  3. A baseline approach Correct answer.
  4. A bespoke approach

Explanation

A baseline approach applies a common minimum set of controls everywhere for consistency and efficiency. It is often supplemented by additional controls where a system's risk is higher than the baseline assumes.