The business impact analysis (BIA) identifies critical services, acceptable downtime limits, and the business consequences of disruptions. CRISC emphasizes that the BIA is the foundation for deciding risk treatment strategies because it defines what must be restored first and to what level. Scenario analysis identifies risks but does not determine business priorities. Failover procedures are themselves a treatment, not a method for selecting treatments. A risk treatment plan documents chosen actions but depends entirely on the BIA to inform those decisions. Therefore, the BIA is the key input enabling proper treatment selection during disasters.
Reference: CRISC Review Manual - Risk Response and Mitigation (BIA-driven decision making).

Risk policies provide the best indication of an organization's risk tolerance, as they define the acceptable level of risk and the risk appetite of the organization. Risk policies also establish the roles and responsibilities, methodologies, and reporting mechanisms for risk management. Risk sharing strategy, risk transfer agreements, and risk assessments are not the best indicators of risk tolerance, as they are more related to risk response, risk mitigation, and risk identification, respectively. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.1.2, page 19.

The most effective way to promote organization-wide awareness of data security in response to an increase in regulatory penalties for data leakage is to require training on the data handling policy, as it educates the employees on the importance, requirements, and procedures of data protection, and enhances their knowledge and skills to prevent, detect, and respond to data leakage incidents. Enforcing sanctions for noncompliance with security procedures, conducting organization-wide phishing simulations, and requiring regular testing of the data breach response plan are not the most effective ways, as they are more related to the enforcement, evaluation, or improvement of the data security, respectively, rather than the promotion of the data security awareness. References = CRISC Review Manual, 7th Edition, page 155.

The risk practitioner's best course of action when an organization has been made aware of a newly discovered critical vulnerability in a regulatory reporting system is to perform an impact assessment, as it involves estimating the potential consequences or damage that the vulnerability may cause to the system and its related business processes, and prioritizing the risk response accordingly. The other options are not the best courses of action, as they may not address the urgency or severity of the vulnerability, or may require the prior knowledge of the impact or risk level, respectively. References = CRISC Review Manual, 7th Edition, page
100.

Role-based access controls (RBAC) are a type of preventive control that limit the access and actions of users based on their roles and responsibilities within the organization. RBAC can help to address the risk of malicious outsiders modifying application data by restricting their access to the data and the functions they can perform on it. RBAC can also enforce the principle of least privilege, which means that users only have the minimum level of access required to perform their tasks. RBAC can be implemented through policies, procedures, and technical mechanisms such as access control lists, encryption, and authentication. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.2.1.1, p. 178-179