Occurrences of specific events are the most likely to cause a key risk indicator (KRI) to exceed thresholds, as they represent the actual or potential realization of the risk. A KRI is a metric that measures the level of risk exposure and the effectiveness of risk response strategies, and it has predefined thresholds that indicate the acceptable or unacceptable risk status. When a specific event occurs that affects the risk, such as a security breach, a system failure, or a compliance violation, the KRI value may change and exceed the thresholds, triggering an alert or an action. A performance measurement, the risk tolerance level, and risk scenarios are not the most likely to cause a KRI to exceed thresholds, as they do not reflect the actual or potential occurrence of the risk, but rather the expected or desired outcome, limit, or simulation of the risk. References = [CRISC Review Manual (Digital Version)], page 121; CRISC by Isaca Actual Free Exam Q&As, question 217.

Regulatory and legal compliance dictate data retention requirements, making them the primary basis for retention decisions.
Reference:CRISC Manual - Domain 1, Slide 462, 560

Warning banners on login screens serve as deterrent controls. Deterrent controls are designed to discourage individuals from attempting unauthorized actions by warning them of potential consequences.
* Purpose of Warning Banners
* Warning banners provide clear notice to users, both authorized and unauthorized, that their activities may be monitored and that unauthorized access is prohibited.
* They serve as a legal disclaimer, which can be crucial in prosecuting unauthorized access attempts.
* Effectiveness as a Deterrent Control
* The primary function of a warning banner is to deter potential intruders by making them aware of the surveillance and legal implications of unauthorized access.
* For authorized users, it reinforces awareness of the organization's security policies and acceptable use agreements.
* Comparison with Other Control Types
* A. Corrective: These controls are used to correct or restore systems after an incident.
* B. Preventive: These controls are designed to prevent security incidents from occurring.
* C. Detective: These controls are used to detect and alert about security incidents.
* D. Deterrent: These controls are intended to discourage individuals from performing unauthorized activities.
References
* Sybex-CISSP-Official-Study-Guide-9-Edition.pdf, p. 829, detailing the role of warning banners as deterrent controls.

The primary purpose of creating and documenting control procedures is to help manage risk to acceptable tolerance levels. Control procedures are the specific actions or steps that are performed to achieve the control objectives and mitigate the risks. Control procedures should be documented to provide clear guidance, consistency, and accountability for the control activities. Documenting control procedures also helps to monitor and evaluate the effectiveness and efficiency of the controls, and to identify and address any gaps or weaknesses. The other options are not the primary purpose of creating and documenting control procedures, although they may be secondary benefits or outcomes. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.2, page 1-15.