NO.228 What action should be taken by a business line that is unwilling to accept the residual risk in a system after implementing compensating controls?
Residual risk is the risk that remains after implementing controls to mitigate the original risk. If a business line is unwilling to accept the residual risk in a system, one possible action is to purchase insurance to cover the potential losses or damages that may result from the residual risk. This is a form of risk transfer, which is one of the four risk management strategies, along with risk avoidance, risk mitigation, and risk acceptance.
Notifying the audit committee, implementing operational safeguards, and finding another business line are not valid actions to deal with residual risk . References: [CISSP All-in-One Exam Guide, Eighth Edition, Chapter
1, page 32]; [CISSP CBK, Fifth Edition, Chapter 2, page 151].
NO.233 What is the PRIMARY purpose of auditing, as it relates to the security review cycle?
Auditing is the process of examining and evaluating the organization’s security controls and policies, such as access control, encryption, backup, incident response, or disaster recovery, to determine if they are working as intended, and if they are compliant with the organization’s objectives, standards, and regulations. Auditing is an essential part of the security review cycle, which is the process of continuously monitoring, assessing, and improving the organization’s security posture. The primary purpose of auditing, as it relates to the security review cycle, is to ensure the organization’s controls and policies are working as intended, and to identify and report any gaps, weaknesses, or violations that may affect the organization’s security. Auditing does not necessarily ensure the organization can still be publicly traded, as this depends on other factors, such as the financial performance, the market demand, or the legal compliance of the organization. Auditing does not necessarily ensure the organization’s executive team won’t be sued, as this depends on other factors, such as the nature, severity, or responsibility of the security incidents or breaches that may occur in the organization.
Auditing does not necessarily ensure the organization meets contractual requirements, as this depends on the specific terms and conditions of the contracts that the organization has with its customers, partners, or suppliers. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 7: Security Operations, page 339. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8: Business Continuity and Disaster Recovery Planning, page 476.
