CRISC cheat sheet

Governance evaluates, directs, and monitors; management plans, builds, runs, and monitors activities in line with that direction.

Risk appetite is set by the board or executive management; risk tolerance defines the acceptable variance around a specific objective.

Three lines model: the first line owns and manages risk, the second line provides risk and compliance oversight, the third line (internal audit) gives independent assurance.

COBIT 2019 separates governance and management objectives and applies design factors to tailor the governance system to the enterprise.

The risk owner is accountable for managing a risk; the control owner is accountable for a control's design, operation, and evidence.

IT strategy must be traceable to enterprise strategy through a documented business case and portfolio prioritization.

KPIs measure performance and goal achievement; KRIs measure movement in risk exposure against defined thresholds.

Legal, regulatory, and contractual obligations are compliance requirements that must be mapped to specific controls and monitored.

Segregation of duties separates authorization, custody of assets, and record-keeping so no single person controls an entire transaction.

Risk = likelihood x impact; scenario form is threat x vulnerability x asset value.

Inherent risk exists before controls; residual risk remains after controls are applied and tested.

SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).

A BIA identifies critical processes and sets RTO, RPO, and MTD; the MTD is the outer limit and must be greater than or equal to the RTO.

Qualitative assessment uses ordinal scales (high/medium/low); quantitative assessment uses monetary values and statistical distributions.

Control testing verifies design effectiveness first, then operating effectiveness through inquiry, observation, inspection, and re-performance.

Common techniques include Delphi, scenario analysis, Monte Carlo simulation, decision trees, bow-tie analysis, and fault tree analysis.

A risk register records ID, description, cause, consequence, owner, likelihood, impact, score, response, KRI, and status.

Risk ranking and aggregation allow comparison of total exposure against risk appetite to prioritize response.

Response options are mitigate, transfer, avoid, accept, and exploit; selection depends on cost-benefit and alignment with risk appetite.

Residual risk above tolerance must be escalated to higher management or the board with a documented, dated decision.

Control types are preventive, detective, and corrective; directive controls guide behavior, and compensating controls substitute when a primary control fails.

A control is justified only when its annual cost is less than the expected reduction in annualized loss expectancy.

Risk register updates include the treatment plan, target date, owner, status, and KRI trend; risks are re-rated after treatment.

Reporting is audience-tailored: the board receives aggregated heat maps and appetite position; management receives operational detail.

KRIs carry green/amber/red thresholds with escalation triggers tied directly to the defined risk tolerance.

An issue is a present problem tracked to closure; a risk is a potential future event tracked to acceptance or treatment.

Exception and waiver requests require justification, compensating controls, an expiration date, and approval at the correct authority level.

CIA triad: confidentiality, integrity, and availability; each control should map to at least one of these objectives.

Authentication proves identity, authorization determines permitted actions, and accountability is delivered through logging and audit trails.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA/ECC) supports key exchange and signatures; hashing (SHA-256) provides integrity only.

Digital signatures provide authentication, integrity, and non-repudiation, but they do not provide confidentiality.

IDS detects and alerts, IPS blocks inline, firewalls filter by policy, and a DMZ segregates internet-facing systems from the internal network.

Cloud shared responsibility: the provider secures the cloud infrastructure; the customer secures data, identity, and configuration, with the split varying by IaaS, PaaS, and SaaS.

The 3-2-1 backup rule means three copies, on two media types, with one copy offsite; backups must be restoration-tested.

Change management requires a request, impact and risk assessment, approval, testing, and a rollback plan before deployment.

Zero trust means verify explicitly, apply least privilege, and assume breach; MFA and privileged access management reduce credential-based risk.