Sensitivity and reliability are the most important criteria for selecting KRIs, as they indicate how well the KRIs reflect the changes in the risk level and how consistent and accurate the KRIs are in measuring the risk.
Sensitivity means that the KRIs should respond quickly and proportionally to the variations in the risk exposure, and provide early warning signals of potential risk events. Reliability means that the KRIs should be based on valid and verifiable data sources, and produce consistent and comparable results over time and across different units or functions. Historical data availability, implementation and reporting effort, and ability to display trends are also useful criteria, but they are not as critical as sensitivity and reliability.
References:
*ISACA, Risk IT Framework, 2nd Edition, 2019, p. 751
*ISACA, Risk and Information Systems Control Review Manual, 7th Edition, 2020, p. 2122

Review Assignments of Data Ownership for Key Assets:
Data Ownership: Ensuring that data ownership is clearly assigned helps establish accountability for data protection. Data owners are responsible for the classification, management, and protection of data.
Baseline Understanding: Reviewing data ownership assignments provides a baseline understanding of who is responsible for sensitive data and ensures that the responsibilities are clearly defined and understood.
Compliance and Control: Proper data ownership ensures that controls are in place and that there is compliance with data protection policies and regulations.
Comparison with Other Options:
Identify Staff Who Have Access to Sensitive Data: This is important but should follow the establishment of clear data ownership to ensure that access controls are appropriately applied.
Identify Recent and Historical Incidents Involving Data Loss: Reviewing incidents helps understand past issues but does not address current data ownership and accountability.
Review the Organization's Data Inventory: While important, a data inventory review is part of understanding data ownership and control but should not be the first step.
Best Practices:
Clear Documentation: Ensure that data ownership is clearly documented and communicated across the organization.
Regular Reviews: Conduct regular reviews of data ownership assignments to ensure they remain accurate and up-to-date.
Training and Awareness: Provide training to data owners on their roles and responsibilities regarding data protection and risk management.
References:
CRISC Review Manual: Highlights the importance of data ownership in managing and protecting sensitive information within an organization.
ISACA Guidelines: Recommend establishing clear data ownership and accountability as a foundational step in effective data risk management.

The first course of action for a risk practitioner when discovering a deficiency in a critical system that cannot be patched is to conduct a risk assessment. A risk assessment is a process of identifying, analyzing, and evaluating the risks that could affect the achievement of the objectives of the system or the organization. A risk assessment helps to determine the level and nature of the risk exposure, and to prioritize and respond to the risks. Conducting a risk assessment is the first course of action, as it helps to understand the source, cause, and impact of the deficiency, and to estimate the likelihood and consequences of the risk events that could exploit the deficiency. Conducting a risk assessment also helps to identify and evaluate the existing or potential controls or mitigations that could address the deficiency, and to recommend the appropriate risk treatment options. Reporting the issue to internal audit, submitting a request to change management, and reviewing the business impact assessment are not the first courses of action, as they are either the outputs or the inputs of the risk assessment process, and they do not address the primary need of assessing the risk situation and status. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 49.

The correct answer isCbecauseinsufficient IoT policies and procedurescreate the greatest security risk. In an environment with many IoT devices, governance and control are essential. Without clear policies and procedures, the organization may fail to define security requirements, ownership, configuration standards, patching responsibilities, access restrictions, monitoring expectations, and acceptable use requirements. This creates widespread unmanaged exposure across the network.
The other choices are less significant from a security-risk perspective:
* A. Inadequate network bandwidthis mainly a performance issue.
* B. Lack of interoperability between IoT devicesis primarily an operational or compatibility issue.
* D. Increased maintenance costs for IoT devicesis a financial concern, not the greatest direct security risk.
Exact Extracts supporting the answer:
* "When evaluating risks related to Internet of Things (IoT) devices used on enterprise networks the first recommendation should address IoT devices with hard-coded passwords."
* "Enterprise policies are the most influential factor in determining an enterprise's approach to risk management."
* "The BEST way to identify IS control deficiencies is through defined control objectives."
* "The MOST important criterion when reviewing information security controls is ensuring that the controls are effectively addressing risk." These extracts show that IoT risk must be addressed through governance, defined requirements, and effective controls. Since policies and procedures establish how IoT devices are secured and managed, insufficient IoT policies and procedures present the greatest security risk.