Explanation/Reference:
Explanation:
Strategic risks are those risks which have potential outcome of not fulfilling on strategic objectives of the organization as planned. Since the strategic objective will shape and impact the entire organization, the risk of not meeting that objective can impose a great threat on the organization.
Strategic risks can be broken down into external and internal risks:
External risks are those circumstances from outside the enterprise which will have a potentially

damaging or helpful impact on the enterprise. These risks include sudden change of economy, industry, or regulatory conditions. Some of the external risks are predictable while others are not. For instance, a recession may be predictable and the enterprise may be able to hedge against the dangers economically; but the total market failure may not as predictable and can be much more devastating.
Internal risks usually focus on the image or reputation of the enterprise. some of the risks that are

involved in this are public communication, trust, and strategic agreement from stakeholders and customers.

Section: Volume B
Explanation:
To ensure greater buy-in and ownership, risk indicators should be selected with the involvement of relevant stakeholders. Risk indicators should be identified for all stakeholders and should not focus solely on the more operational or strategic side of risk.
Incorrect Answers:
A: Role of lag indicators is to ensure that risk after events have occurred is being indicated.
B: Lead indicators indicate which capabilities are in place to prevent events from occurring. They do not play any role in ensuring greater buy-in and ownership.
C: Root cause is considered while selecting risk indicator but it does not ensure greater buy-in or ownership.

Explanation/Reference:
Explanation:
Organizations create different security plans to address different scenarios. Many of the security plans are common to most organizations.
Most used security plans found in many organizations are:
Business continuity plan

Disaster recovery plan

Backup plan

Incident response plan

Incorrect Answers:
D: Project management plan is not a security plan, but a plan which describes the implementation of the project.

Section: Volume D