Senior management has asked the risk practitioner for the overall residual risk level for a process that contains numerous risk scenarios. Which of the following should be provided?

A highly regulated organization acquired a medical technology startup company that processes sensitive personal information with weak data protection controls. Which of the following is the BEST way for the acquiring company to reduce its risk while still enabling the flexibility needed by the startup company?

Which of the following criteria is MOST important when developing a response to an attack that would compromise data?

The BEST way to improve a risk register is to ensure the register:

In addition to the risk register, what should a risk practitioner review to develop an understanding of the organization's risk profile?