説明/参照:
Explanation:
制御を効果的に評価するには、制御が運用されている環境内で制御目標がどの程度正確に達成されているかを判断する必要があります。制御が適切にテストされるまで、制御の強度に関する結論は出せません。
誤った回答:
A: 制御と運用環境の整合は不可欠ですが、制御が目的を正確に達成できるかどうかはその後に重要です。言い換えれば、制御を評価する上で、目的の達成が最優先事項です。
B: 制御の設計の有効性も考慮されますが、これは目標を達成した後に考慮されます。
D: 目標達成の正確さを考慮した後に、制御の運用有効性が考慮されます。

Section: Volume B
Explanation:
Integrated change control is responsible for facilitating, documenting, and dispersing information on a proposed change to the project scope.
Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project.
Incorrect Answers:
A: The configuration management system controls and documents changes to the project's product C: The change log documents approved changes in the project scope.
D: The scope change control system controls changes that are permitted to the project scope.

An IT risk register is a document that records and tracks the IT-related risks that an organization faces, as well as the information and actions related to those risks, such as the risk description, assessment, response, status, and owner. An IT risk register is a valuable tool for managing and communicating IT risks and their impact on the organization's objectives and operations. However, an IT risk register may also contain sensitive or confidential information that should not be disclosed or shared with unauthorized or irrelevant parties, as it may compromise the security, privacy, or reputation of the organization or its stakeholders. Therefore, the risk manager's best approach to the request from the head of a business operations department to review the entire IT risk register is to determine the purpose of the request before sharing the register. This is a technique to understand and evaluate the reason and the need for the request, as well as the scope and the level of access that the requester requires or expects. By determining the purpose of the request, the risk manager can ensure that the request is legitimate, appropriate, and relevant, and that the requester has a clear and valid interest or stake in the IT risk register. The risk manager can also ensure that the request is aligned with the organization's policies, procedures, and standards for IT risk management and information sharing. The risk manager can also use the purpose of the request to decide what and how much information to share with the requester, and what conditions or restrictions to apply, such as confidentiality, accuracy, or timeliness. The other options are not the best approaches to the request from the head of a business operations department to review the entire IT risk register, as they may be premature, unnecessary, or ineffective. Escalating to senior management is a technique to involve or inform the higher-level authorities or decision makers about the request, which may be useful or required in some cases, but it may not be the first or the best step to take, as it may delay or complicate the process, or undermine the risk manager's authority or responsibility. Requiring a nondisclosure agreement is a technique to protect the confidentiality and integrity of the information in the IT risk register by legally binding the requester to not disclose or misuse the information. However, a nondisclosure agreement may not be needed or appropriate in every case, and it may not prevent or address other issues or risks related to the information sharing, such as relevance, accuracy, or timeliness. Sanitizing portions of the register is a technique to remove or redact the sensitive or confidential information from the IT risk register before sharing it with the requester, which may be necessary or prudent in some cases, but it may not be sufficient or satisfactory, as it may affect the completeness, usefulness, or validity of the information, or raise questions or concerns from the requester.

説明/参照:
Explanation:
デイビッドはリスクを回避するために電子商取引に従事しなかったため、リスク回避戦略に従っています。

* A security awareness training program is an educational program that aims to equip the organization's employees with the knowledge and skills they need to protect the organization's data and sensitive information from cyber threats, such as hacking, phishing, or other breaches12.
* A risk-aware culture is a culture that values and promotes the understanding and management of risks, and encourages the behaviors and actions that support the organization's risk objectives and strategy34.
* The best indication of an improved risk-aware culture following the implementation of a security awareness training program for all employees is an increase in the number of incidents reported, which is the frequency or rate of security incidents that are detected and communicated by the employees to the appropriate authorities or channels56.
* An increase in the number of incidents reported is the best indication because it shows that the employees have gained the awareness and confidence to recognize and report the security incidents that may affect the organization, and that they have the responsibility and accountability to contribute to the organization's risk management and security posture56.
* An increase in the number of incidents reported is also the best indication because it enables the organization to respond and recover from the security incidents more quickly and effectively, and to prevent or reduce the recurrence or escalation of similar incidents in the future56.
* The other options are not the best indication, but rather possible outcomes or consequences of an improved risk-aware culture or a security awareness training program. For example:
* A reduction in the number of help desk calls is an outcome of an improved risk-aware culture or a security awareness training program that indicates the employees have become more self-reliant and proficient in solving or preventing the common or minor IT issues or problems . However, this outcome does not measure the employees' awareness or reporting of security incidents, which may be more serious or complex .
* An increase in the number of identified system flaws is a consequence of an improved risk-aware culture or a security awareness training program that indicates the employees have become more vigilant and proactive in finding and reporting the vulnerabilities or weaknesses in the IT systems or processes . However, this consequence does not measure the employees' awareness or reporting of security incidents, which may exploit or leverage the system flaws .
* A reduction in the number of user access resets is an outcome of an improved risk-aware culture or a security awareness training program that indicates the employees have become more careful and responsible in managing and protecting their user credentials or accounts . However, this outcome does not measure the employees' awareness or reporting of security incidents, which may compromise or misuse the user access . References
* 1: Security Awareness Training - Cybersecurity Education Online | Proofpoint US5
* 2: What Is Security Awareness Training and Why Is It Important? - Kaspersky6
* 3: Risk IT Framework, ISACA, 2009
* 4: IT Risk Management Framework, University of Toronto, 2017
* 5: Security Incident Reporting and Response, University of Toronto, 2017
* 6: Security Incident Reporting and Response, ISACA, 2019
* : IT Help Desk Best Practices, ISACA Journal, Volume 2, 2018
* : IT Help Desk Best Practices, ISACA Now Blog, February 12, 2018
* : System Flaw Reporting and Remediation, University of Toronto, 2017
* : System Flaw Reporting and Remediation, ISACA, 2019
* : User Access Management and Control, University of Toronto, 2017
* : User Access Management and Control, ISACA, 2019