This behavior represents intentional circumvention of control, requiring formal documentation and assessment as a noncompliance risk scenario.
CRISC principle:
"When control circumvention occurs, the risk practitioner should document the event as a noncompliance risk scenario to evaluate its impact and treatment." The other options-auditing, probability updates, or cost analysis-may follow, but the first step is formal recognition of the risk within the risk register via a new scenario.
CRISC Reference: Domain 2 - IT Risk Assessment, Topic: Scenario Development and Control Evaluation.

Local laws and regulations should be the primary consideration when assessing the risk of using IoT devices to collect and process PII, because they define the legal obligations and liabilities of the organization and the individuals involved. Non-compliance with local laws and regulations can result in fines, lawsuits, reputational damage, and loss of trust. Therefore, it is essential to understand and adhere to the applicable laws and regulations in the jurisdictions where the IoT devices operate and where the PII is stored, processed, and transferred.
References
*Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks
*The Internet of Things (IoT) and Digitally Stored PII: Avoidable or Inevitable?
*Security Issues in IoT: Challenges and Countermeasures

A preventive control is a type of control that aims to avoid or reduce the occurrence of an undesirable event or risk. A preventive control can be implemented through technical, administrative, or physical means. A new policy that forbids copying of data onto removable media is an example of a preventive control, because it prevents unauthorized data exfiltration or leakage through removable devices, such as flash drives or external hard disk drives. A preventive control is different from the other types of controls, as explained below:
* A detective control is a type of control that aims to discover or identify the occurrence of an undesirable event or risk. A detective control can be implemented through monitoring, auditing, or reporting activities. An example of a detective control is a log analysis tool that detects any unauthorized access or modification of data on a system.
* A directive control is a type of control that aims to guide or instruct the behavior or actions of individuals or groups. A directive control can be implemented through policies, procedures, standards, or rules. An example of a directive control is a training program that teaches employees how to handle sensitive data securely and appropriately.
* A deterrent control is a type of control that aims to discourage or dissuade individuals or groups from performing an undesirable event or risk. A deterrent control can be implemented through sanctions, penalties, or consequences. An example of a deterrent control is a warning message that informs users of the legal implications of copying data onto removable media without authorization. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.1, page 38.

Developing IT Risk Scenarios:
Risk scenarios are hypothetical events that describe potential threats and their impact on business operations.
These scenarios are essential for identifying and assessing risks.
Importance of Potential Impact Events:
Events that could potentially impact the business provide the most useful information for developing risk scenarios because they directly relate to the organization's objectives and operations.
Understanding these events helps in crafting realistic and relevant risk scenarios that can guide risk assessment and mitigation efforts.
Components of Risk Scenarios:
Threat Actors:Identify who might exploit vulnerabilities.
Threat Events:Describe the specific events that could impact the business.
Business Impact:Assess how these events would affect business operations, finances, reputation, etc.
Using Impact Events for Scenario Development:
Focusing on events that could disrupt critical business functions ensures that the scenarios are relevant and actionable.
It enables the risk practitioner to communicate the potential consequences effectively to stakeholders and prioritize mitigation efforts accordingly.
Comparing Other Information Sources:
Published Vulnerabilities:Useful for understanding specific threats but may not directly relate to business impact.
Threat Actors:Important for identifying potential sources of risk but not sufficient alone for scenario development.
IT Assets:Relevant for risk assessment but secondary to understanding potential impact events.
References:
The CRISC Review Manual discusses the importance of considering events that could impact the business when developing risk scenarios (CRISC Review Manual, Chapter 2: IT Risk Assessment, Section 2.4 Risk Scenario Development).