When using a third party to perform penetration testing, the most important control to minimize operational impact is to clearly define the project scope. This means specifying the objectives, boundaries, methods, and deliverables of the testing, as well as the roles and responsibilities of the parties involved. A clear project scope helps to avoid misunderstandings, conflicts, and disruptions that could compromise the security, availability, or integrity of the systems under test. It also helps to ensure that the testing is aligned with the organization's risk appetite and compliance requirements. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 3, Section 3.2.3.2, Page 137.

A change management process is a set of procedures and activities that aim to ensure that changes in an organization's IT systems and services are implemented in a controlled and coordinated manner. The effectiveness of a change management process can be measured by how well it reduces the risks and costs associated with changes, and how well it supports the business objectives and customer expectations. One of the best metrics to demonstrate the effectiveness of a change management process is the percent of unauthorized changes. Unauthorized changes are changes that are made without following the established change management process, such as obtaining approval, documenting the change, testing the change, and communicating the change. Unauthorized changes can introduce errors, defects, security breaches, and disruptions to the IT systems and services, and can negatively affect the business performance and customer satisfaction. Therefore, a low percent of unauthorized changes indicates that the change management process is effective in ensuring that changes are properly planned, approved, executed, and monitored. The other options are not the best metrics to demonstrate the effectiveness of a change management process, as they do not directly reflect the quality and control of the changes. An increase in the frequency of changes may indicate that the organization is agile and responsive to the changing business needs and customer demands, but it does not necessarily mean that the changes are well-managed and beneficial. An increase in the number of emergency changes may indicate that the organization is able to handle urgent and critical situations, but it may also suggest that the organization is reactive and lacks proper planning and analysis of the changes. The average time to complete changes may indicate the efficiency and speed of the change management process, but it does not measure the effectiveness and value of the changes. References = CRISC Review Manual, pages 156-1571; CRISC Review Questions, Answers & Explanations Manual, page 712

A virus transmitted on a USB thumb drive is a scenario that represents a threat, as it involves a malicious or harmful event that could compromise the confidentiality, integrity, or availability of an information system. A virus is a type of malware that can infect and damage files, programs, or devices by replicating itself and spreading to other systems or networks. A USB thumb drive is a portable storage device that can be used to transfer data between computers or devices. A virus transmitted on a USB thumb drive can occur when a user inserts an infected USB thumb drive into a computer or device, or when a user downloads or copies an infected file from a USB thumb drive to a computer or device. A virus transmitted on a USB thumb drive can pose a serious risk to the information system, as it can corrupt or delete data, disrupt or degrade performance, steal or leak information, or allow unauthorized access or control.
The other options are not scenarios that represent a threat, but rather vulnerabilities or weaknesses that could increase the likelihood or impact of a threat. Connecting a laptop to a free, open, wireless access point (hotspot) is a vulnerability, as it exposes the laptop to potential eavesdropping, interception, or manipulation by malicious actors on the same network. Visitors not signing in as per policy is a vulnerability, as it creates a gap in the physical security and access control of the premises, and could allow unauthorized or malicious visitors to enter or access sensitive areas or assets. Storing corporate data in unencrypted form on a laptop is a vulnerability, as it reduces the protection and security of the data, and could enable unauthorized or malicious access, disclosure, or modification of the data in case of loss, theft, or compromise of the laptop. References = What is a Computer Virus? | McAfee, What is a USB Flash Drive? | Kingston Technology, Threats, Vulnerabilities, and Exploits - oh my!

* To reduce risk impact, the best course of action is to implement corrective measures, which are actions taken to eliminate or minimize the negative effects of a risk event after it has occurred12.
* Corrective measures can include restoring normal operations, repairing or replacing damaged assets, recovering lost data, compensating affected stakeholders, and implementing lessons learned12.
* Corrective measures can reduce risk impact by minimizing the duration, severity, and scope of the consequences of a risk event, as well as preventing recurrence or escalation of similar risks in the future12.
* The other options are not the best course of action to reduce risk impact, but rather different types of risk responses that may have different objectives and effects. For example:
* Creating an IT security policy is an example of a preventive measure, which is an action taken to avoid or reduce the likelihood of a risk event before it occurs12. A preventive measure can reduce risk exposure, but not risk impact.
* Implementing detective controls is an example of a monitoring measure, which is an action taken to identify and measure the occurrence or status of a risk event during or after it occurs12. A monitoring measure can provide timely information and feedback, but not reduce risk impact.
* Leveraging existing technology is an example of a mitigation measure, which is an action taken to reduce the likelihood or impact of a risk event before it occurs12. A mitigation measure can reduce risk exposure, but not necessarily risk impact. References =
* 1: Risk Management Guide for Information Technology Systems, NIST Special Publication 800-30, July 2002
* 2: Project Risk Management Handbook, California Department of Transportation, June 2011

The most essential content to include in an IT risk awareness program is how to comply with the organization's IT risk and information security policies. This will help to ensure that the staff members are aware of their roles and responsibilities, and that they follow the best practices and standards to protect the organization's information assets and systems. Compliance with the IT risk and information security policies also helps to reduce the likelihood and impact of IT-related incidents and breaches, and to align the IT activities with the organization's objectives and strategies. Populating risk register entries, prioritizing IT-related actions, and defining the IT risk framework are important aspects of IT risk management, but they are not the most essential content to include in an IT risk awareness program. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section 5.1.1.2, page 2291
1: ISACA Certified in Risk and Information Systems Control (CRISC) Exam Guide, Answer to Question
646.