Information Systems Control Design and Implementation Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Systems Control Design and Implementation flashcards as text
What is change management control, and why is it important in IT risk management?
Answer: A formal process to evaluate, approve, and document changes to IT systems before implementation to prevent unauthorized or disruptive changes
Change management controls prevent unauthorized, untested, or poorly planned changes from introducing new vulnerabilities or disruptions to IT systems.
What is the purpose of a configuration management database (CMDB)?
Answer: To maintain a centralized record of all IT assets and their relationships, supporting change and incident management
A CMDB provides a comprehensive inventory of IT assets and their interdependencies, enabling better change impact analysis and faster incident resolution.
Which control ensures that only tested and approved software is deployed in the production environment?
Answer: Separation of development, testing, and production environments
Maintaining separate environments ensures that code is tested in a controlled setting before reaching production, preventing untested changes from causing incidents.
What is the concept of 'privacy by design' in information systems control?
Answer: Incorporating data protection and privacy controls into systems from the initial design phase rather than adding them later
Privacy by design embeds privacy protections into the architecture and processes of systems from the ground up, making privacy a default feature rather than an afterthought.
What is an access control matrix?
Answer: A table that maps subjects (users/systems) to objects (resources) and defines the permitted operations for each combination
An access control matrix provides a structured view of who or what can access which resources and what actions they are permitted to perform, supporting the principle of least privilege.
What is the purpose of an IT general control (ITGC) review?
Answer: To assess the effectiveness of controls that govern the overall IT environment supporting financial and operational systems
ITGC reviews examine controls like change management, access administration, and operations management that underpin all systems and are fundamental to reliable financial and operational reporting.