The percentage of risk investments with defined business cases is a metric that measures how well the
information security program aligns with the operational objectives of the organization. It indicates how many
of the security-related investments are justified by a clear analysis of the expected benefits, costs, and risks,
and how they support the business goals and priorities. This metric can help the organization optimize its
security spending, demonstrate the value of security to the stakeholders, and align the security strategy with
the business strategy1. References = Performance Measurement Guide for Information Security, Section 3.2.3,
page 16; Key Performance Indicators for Security Governance, Part 1, Section 3, page 3.

Personally identifiable information (PII) is any data that can be used to identify, contact, or locate a specific individual, either alone or combined with other sources. PII includes information such as name, address, phone number, email address, social security number, etc. Patient names are examples of PII, and therefore the data that contains them should be masked or anonymized to protect the privacy and security of the patients. Confidential information, protected health information, and security clearance are not types of data, but rather categories or levels of data sensitivity that may require different degrees of protection or access control. Reference = CompTIA Project+ Study Guide, Chapter 3: Project Planning, Section 3.4: Data Privacy and Security, p. 121; Patient Data: Types, Uses & Hospital Patient Databases; What is Patient Data and Why Is It Important?; Chapter 1 - Registrar Playbook

Incorrect configuration was the initial cause of the issue that caused the unexpected crash of the website that the team was developing. The diagram given is an example of a fishbone diagram or a cause-and-effect diagram that shows the possible causes of a problem or effect. The diagram has four main categories: people, process, technology, and environment. Each category has subcategories that list specific factors that may contribute to the problem or effect. The diagram shows that incorrect configuration under technology was marked as an initial cause of website crash.

Language barriers can lead to misunderstandings within a global project team, causing misinterpretations of project requirements or features. In this case, the development team misinterpreted which features needed to be incorporated into the demo presentation due to communication issues, likely stemming from language differences. This highlights the importance of clear communication and understanding in a diverse project team.

Scope creep is most likely happening when a key stakeholder recommends to a senior developer that a new
feature be added that is not part of the current requirement documentation. Scope creep is a term that refers to
the uncontrolled expansion or change of a project's scope beyond its original boundaries or objectives. Scope
creep can happen due to various reasons, such as changing customer demands, unclear or incomplete
requirements, poor communication, lack of change control, or stakeholder interference. Scope creep can have
negative impacts on a project, such as delays, cost overruns, quality issues, or reduced customer satisfaction12