CRISC考试包括哪些内容?

The governance domain interrogates your knowledge of information about an organization’s business and IT environments, 组织策略, 目标和目的, and examines potential or realized impacts of IT risk to the organization’s business objectives and operations, including 澳门赌场官方下载 Risk Management and Risk Management Framework.

This domain will certify your knowledge of threats and vulnerabilities to the organization’s people, processes and technology as well as the likelihood and impact of threats, 漏洞和风险场景.

This domain deals with the development and management of risk treatment plans among key stakeholders, the evaluation of existing controls and improving effectiveness for IT risk mitigation, and the assessment of relevant risk and control information to applicable stakeholders.

In this domain we interrogate the alignment of business practices with Risk Management and Information Security frameworks and standards, as well as the development of a risk-aware culture and implementation of security awareness training.

1. Collect and review existing information regarding the organization’s business and IT environments.
2. Identify potential or realized impacts of IT risk to the organization’s business objectives and operations.
3. Identify threats and vulnerabilities to the organization’s people, processes and technology.
4. Evaluate threats, vulnerabilities and risk to identify IT risk scenarios.
5. Establish accountability by assigning and validating appropriate levels of risk and control ownership.
6. Establish and maintain the IT risk register and incorporate it into the enterprise-wide risk profile.
7. Facilitate the identification of risk appetite and risk tolerance by key stakeholders.
8. Promote a risk-aware culture by contributing to the development and implementation of security awareness training.
9. Conduct a risk assessment by analyzing IT risk scenarios and determining their likelihood and impact.
10. Identify the current state of existing controls and evaluate their effectiveness for IT risk mitigation.
11. Review the results of risk analysis and control analysis to assess any gaps between current and desired states of the IT risk environment.
12. Facilitate the selection of recommended risk responses by key stakeholders.
13. Collaborate with risk owners on the development of risk treatment plans.
14. 与控制所有者合作进行选择, 设计, 控制的实施和维护.
15. Validate that risk responses have been executed according to risk treatment plans.
16. 定义和建立关键风险指标(KRIs).
17. 监控和分析关键风险指标(KRIs).
18. Collaborate with control owners on the identification of key performance indicators (KPIs) and key control indicators (KCIs).
19. Monitor and analyze key performance indicators (KPIs) and key control indicators (KCIs).
20. Review the results of control assessments to determine the effectiveness and maturity of the control environment.
21. Report relevant risk and control information to applicable stakeholders to facilitate risk-based decision-making.
22. Evaluate alignment of business practices with risk management and information security frameworks and standards.