CRISC suggests that asset criticality is determined by thebusiness processes and services the asset enables, and the impact if those processes are disrupted. By mapping IT assets to business processes, the organization can understand which systems support revenue generation, regulatory compliance, safety, or other critical outcomes. The data classification policy helps assess data sensitivity (confidentiality), which is related but not sufficient by itself to determine overall criticality; availability and integrity requirements also matter. The number of business users may indicate importance, but some highly critical systems (e.g., settlement engines, control systems) may have few users yet enormous impact. End-of-life status is relevant for obsolescence risk but does not necessarily correlate with business criticality. Therefore, linking assets to the processes they support is the most reliable basis for defining criticality.
Reference:CRISC Review Manual - IT Risk Assessment (asset-business process mapping and criticality determination).

The correct answer isBbecause aprocess maturity modelis primarily used to determine thegap between the actual state and the desired stateof the risk management process. This is its main value in CRISC: it helps the organization understand current capability, compare it with target capability, and identify where improvement is needed.
The other options are less accurate:
* A. determine the cost of control improvementsmay be done separately through cost-benefit analysis, but it is not the main purpose of a maturity model.
* C. benchmark maturity against industry standardscan be a secondary use, but the primary value is internal gap identification.
* D. reduce audit and regulatory findingsmay occur as an indirect benefit, but it is not the principal purpose.
Exact Extracts supporting the answer:
* "Improving an enterprise's risk management process is most effectively achieved through the use of a maturity model."
* "The most insightful tool for understanding an enterprise's risk management capabilities is a capability maturity model review."
* "A capability maturity model assists risk practitioners in measuring the existing level of development of risk management processes against the desired state."
* "The PRIMARY benefit of using a maturity model to assess the enterprise's data management process is that it helps identify gaps."
* "Measuring the gap between actual and desired states is the primary use of capability models in assessing risk management processes." These extracts directly support that the most useful purpose of a process maturity model is to identify the gap between current and target maturity.

Failing a security test indicates a security control weakness already realized, qualifying as an incident (a deviation from expected security state).
CRISC guidance:
"When a vulnerability or control deficiency is detected through testing or monitoring, it constitutes an information security incident that must be logged and evaluated." A risk event is broader and refers to potential or hypothetical occurrences, not confirmed test failures.
Hence, C. As an incident is correct.
CRISC Reference: Domain 4 - Risk and Control Monitoring, Topic: Incident Management.

* Key risk indicators (KRIs) are metrics that provide information about the level of exposure to a specific risk or a group of risks.
* The most important factor to the effective monitoring of KRIs is determining threshold levels. This means that the acceptable or unacceptable values or ranges of the KRIs are defined and agreed upon by the relevant stakeholders.
* Determining threshold levels helps to evaluate the actual performance and impact of the risks, compare them with the risk appetite and tolerance of the organization, identify any deviations or breaches that may require attention or action, and report them to the appropriate parties for decision making or improvement actions.
* The other options are not the most important factors to the effective monitoring of KRIs. They are either secondary or not essential for KRIs.
The references for this answer are:
* Risk IT Framework, page 15
* Information Technology & Security, page 9
* Risk Scenarios Starter Pack, page 7