A spear phishing attack is a type of cyberattack that targets a specific individual or organization with a fraudulent email that appears to be from a trusted source, and attempts to trick the recipient into clicking a malicious link, opening a malicious attachment, or providing sensitive information. A spear phishing attack can compromise the security, confidentiality, integrity, or availability of the information systems and data of the individual or organization. The most effective way to mitigate the risk associated with spear phishing attacks is to implement a security awareness program, which is a program that educates and trains the employees and stakeholders of the organization about the security policies, procedures, and best practices, and the potential threats and risks that may affect the organization. A security awareness program can help to prevent or reduce the success of spear phishing attacks, as it can increase the knowledge and skills of the employees and stakeholders to recognize and avoid the fraudulent emails, and to report and respond to any suspicious or malicious activities. References = CRISC Review Manual, 7th Edition, page 181.

セクション: ボリューム D

セクション: ボリューム D

A risk practitioner is a person who is responsible for performing risk management activities, such as identifying, analyzing, evaluating, treating, monitoring, and communicating risks. When an organization is implementing a project to automate the purchasing process, including the modification of approval controls, the task that is the responsibility of the risk practitioner is to verify that the existing controls continue to properly mitigate the defined risk. This means that the risk practitioner should ensure that the automation and modification of the approval controls do not introduce new risks or change the existing risk profile, and that the controls are still effective and adequate for the purchasing process. The risk practitioner should also monitor the performance and compliance of the controls, and recommend any improvements or adjustments as needed. References = CRISC Review Manual, 7th Edition, page 177.

A change in the risk profile would be the most important information to communicate to stakeholders after an annual risk assessment is completed, as it indicates how the risk landscape of the organization has changed over time, and how it affects the achievement of the business goals and objectives. A decrease in threats, an increase in reported vulnerabilities, and an increase in identified risk scenarios are also important information, but they are not the most important, as they are specific aspects of the risk profile, and do not provide a holistic view of the risk exposure and appetite of the organization. References = CRISC Review Manual, 7th Edition, page 109.