CRISC · Question #332
Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?
The correct answer is C. Enterprise architecture (EA) documentation. Enterprise architecture documentation provides the most useful information for tracing the impact of aggregated risk across an organization's technical environment.
Question
Which of the following provides the MOST useful information to trace the impact of aggregated risk across an organization's technical environment?
Options
- ABusiness case documentation
- BOrganizational risk appetite statement
- CEnterprise architecture (EA) documentation
- DOrganizational hierarchy
How the community answered
(37 responses)- A8% (3)
- B14% (5)
- C73% (27)
- D5% (2)
Why each option
Enterprise architecture documentation provides the most useful information for tracing the impact of aggregated risk across an organization's technical environment.
Business case documentation primarily justifies projects or investments and typically lacks the granular technical interdependency details needed for tracing risk impacts.
An organizational risk appetite statement defines the acceptable level of risk but does not provide the technical structure or dependencies required to trace aggregated risk.
Enterprise architecture (EA) documentation offers a comprehensive mapping of an organization's IT assets, including applications, systems, data flows, and infrastructure, along with their interdependencies. This detailed view is essential for understanding how a risk event in one component can propagate and aggregate its impact across interconnected technical systems.
Organizational hierarchy illustrates reporting structures and responsibilities, not the technical environment or system interdependencies crucial for tracing risk impact propagation.
Concept tested: Risk aggregation tracing
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1.pdf
Topics
Community Discussion
No community discussion yet for this question.