GISPP - ISACA CRISC - Ch1-Identification
GISPP - ISACA CRISC - Ch1-Identification
If you are using Zoom for the first time than these points will be useful for you .
• If you are unable to hear audio than you need to connect via device audio . Look at the
bottom left corner .
• Kindly turn off your camera while connecting to Zoom as we respect your privacy .
• The Speaker will keep you muted during the session however if you want to ask any
question during QA session ,you can click on the three dots and “raise hand” so that
the speaker can unmute you .
• You can click on the participants tab to chat with host or to send a member to all
participants
• If you are attending the session while doing some other work ,kindly mute yourself in
case if the host unmutes all users during QA session
M. Adnan Khan
CISM, CRISC, VCP-DCV, CCNA, MCSE, CSS
Definition 2:
Risk management is the process of identifying, assessing and
controlling threats to an organization
IT Risk Identification
• Risk tolerance: Risk tolerance levels are deviations from risk appetite
• Residual Risk
• Risk that remains after control has been implemented
• Secondary Risk:
• One risk response may cause second risk event
• Systemic Risk:
• Threats to a system, market or economic segment
• Integrity
• Availability
(Nonrepudiation)
Past Present
• Experience of previous projects or • Contracts
plans or operations
• Tech specs
• Checklists capturing previous
experiences • Resource plans
• Public media • Reviews
Future • Assumption analysis
• Brainstorming • SWOT
• Scenario analysis
• Delphi technique
• Pre-mortem
Global Information Security Society for Professionals of
35
Pakistan
RISK SCENARIOS – “WHAT IF”
• A potential risk event that can affect an organization.
• A risk scenario should include:
• Actor
• Threat type
• Event
• Asset type
• Time
• A. The iterative meetings allow all stakeholders to participate in the risk identification
processes throughout the project phases.
• B. The iterative meetings allow the project manager to discuss the risk events which have
passed the project and which did not happen.
• C. The iterative meetings allow the project manager and the risk identification
participants to identify newly discovered risk events throughout the project.
• D. The iterative meetings allow the project manager to communicate pending risks
events during project execution.
• A. The iterative meetings allow all stakeholders to participate in the risk identification
processes throughout the project phases.
• B. The iterative meetings allow the project manager to discuss the risk events which have
passed the project and which did not happen.
• C. The iterative meetings allow the project manager and the risk identification
participants to identify newly discovered risk events throughout the project.
• D. The iterative meetings allow the project manager to communicate pending risks
events during project execution.
• A. Process flowchart
• B. Ishikawa diagram
• C. Influence diagram
• D. Decision tree diagram
• A. Process flowchart
• B. Ishikawa diagram
• C. Influence diagram
• D. Decision tree diagram