Digital signatures use asymmetric cryptography to bind a signer's identity to a specific message hash. In the CRISC context, they provide multiple security properties-integrity (changes to the message alter the signature) and authentication of the signer-but the key feature asked here isnonrepudiation: the signer cannot plausibly deny having signed the message, assuming private keys are properly protected. Biometrics are unrelated to digital signatures; authentication may be biometric at login, but the signature mechanism is cryptographic. The signature is not necessarily "constant over time" because signatures differ with different messages and may rely on different hash algorithms across periods. Custody of the signature is not limited to the receiver; any verifier with the signer's public key can validate it. Nonrepudiation is therefore the best and most precise control objective associated with digital signatures in insecure networks.
Reference:CRISC Review Manual - Risk Response and Mitigation (security controls; cryptographic controls and nonrepudiation).

Key Risk Indicators (KRIs)are metrics used to monitor changes in risk exposure, enabling proactive adjustments to keep risks within appetite. They provide early warnings of potential breaches in risk thresholds.

End user acceptance testing is a process that verifies that a system or service meets the requirements and expectations of the end users, who are the actual or potential customers or beneficiaries of the system or service. End user acceptance testing is the final stage of testing before the system or service is deployed or released to the production environment. The results of end user acceptance testing are the most important consideration for a risk practitioner when making a system implementation go-live recommendation, as they indicate the quality, functionality, usability, and reliability of the system or service from the end user perspective. The results of end user acceptance testing can help to identify and resolve any defects, errors, or issues that may affect the performance, satisfaction, or acceptance of the system or service by the end users.
The results of end user acceptance testing can also help to evaluate the benefits, value, and risks of the system or service for the end users and the organization. The other options are not the most important consideration for a risk practitioner when making a system implementation go-live recommendation, although they may be relevant and useful. The completeness of system documentation is a factor that affects the maintainability, supportability, and auditability of the system or service, but it does not measure the end user experience or satisfaction. The variances between planned and actual cost is a measure of the efficiency and budget management of the system or service development or implementation, but it does not reflect the end user needs or expectations. The availability of in-house resources is a resource that supports the system or service delivery and operation, but it does not ensure the end user acceptance or approval. References = CRISC Review Manual, pages 180-1811; CRISC Review Questions, Answers & Explanations Manual, page 87

The potential loss to the business due to non-performance of the asset is the most helpful information for asset owners when classifying organizational assets for risk assessment, because it reflects the value and criticality of the asset to the business objectives and processes. The potential loss can be measured in terms of financial, operational, reputational, or legal impacts. The known emerging environmental threats are not relevant for asset classification, because they are external factors that affect the risk level, not the asset value. The known vulnerabilities published by the asset developer are not relevant for asset classification, because they are internal factors that affect the risk level, not the asset value. The cost of replacing the asset with a new asset providing similar services is not relevant for asset classification, because it does not reflect the business impact of losing the asset functionality or availability. References = CRISC Sample Questions 2024