The best way to protect company sensitive information from being exposed when an organization allows employee use of social media accounts for work purposes is to require employees to sign nondisclosure agreements. Nondisclosure agreements are legal contracts that prohibit the employees from disclosing or sharing the company sensitive information with unauthorized parties, such as competitors, media, or regulators. Nondisclosure agreements also specify the scope, duration, and conditions of the nondisclosure obligation, and the penalties or remedies for breaching the agreement. Requiring employees to sign nondisclosure agreements is the best way to protect company sensitive information, as it helps to prevent or deter the employees from exposing or leaking the company sensitive information on social media, and to hold the employees accountable and liable for their actions. Requiring employees to sign nondisclosure agreements also helps to comply with the legal and regulatory requirements for data protection and privacy. Educating employees on what needs to be kept confidential, implementing a data loss prevention (DLP) solution, and taking punitive action against employees who expose confidential data are also useful ways, but they are not as effective as requiring employees to sign nondisclosure agreements, as they are either dependent on the employees' awareness or behavior, or reactive or corrective measures, rather than proactive or preventive measures. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

The control owner is the person who is responsible for designing, implementing, monitoring, and maintaining a control. The control owner is best suited to determine whether a new control properly mitigates data loss risk within a system, as they have the most knowledge and authority over the control. The control owner should also evaluate the effectiveness and efficiency of the control and report any issues or gaps to the risk owner.
The other options are not the best suited to determine whether a new control properly mitigates data loss risk within a system. The data owner is the person who has the accountability and authority over the data and its classification. The data owner may not have the technical expertise or access to evaluate the new control. The risk owner is the person who has the accountability and authority to manage a specific risk. The risk owner may not have the detailed knowledge or involvement in the new control. The system owner is the person who has the accountability and authority over the system and its operation. The system owner may not have the direct responsibility or oversight of the new control. References = CRISC TOPIC 3 EXAM SHORT Flashcards, CRISC-1-50 topic3 Flashcards, CRISC Certified in Risk and Information Systems Control - Question609

A risk practitioner should evaluate the relevance of the evolving threats to the organization's industry, as this is the best course of action to understand the current and future risk landscape, and to align the risk management strategy accordingly. By evaluating the relevance of the evolving threats, the risk practitioner can determine the impact and likelihood of the threats affecting the organization's objectives, assets, and processes, and prioritize the most critical and urgent risks. The risk practitioner can also identify the gaps and weaknesses in the existing controls, and recommend appropriate risk response measures to mitigate the threats.
The other options are not as good as evaluating the relevance of the evolving threats, because they do not address the root cause of the rising security incidents, but rather focus on the symptoms or consequences of the incidents. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.1, page
85.

Section: Volume D

A risk register is a tool that records and tracks the identified risks, their causes, impacts, likelihood, responses, and owners. The greatest concern when maintaining a risk register is that significant changes in risk factors are excluded. Risk factors are the internal and external variables that influence the occurrence and impact of risks.
Risk factors can change over time due to changes in the business environment, the IT landscape, the threat landscape, or the regulatory requirements. If the risk register does not reflect the significant changes in risk factors, it may not provide an accurate and current view of the enterprise's risk profile and may not support effective risk management decisions and actions. The other options are not as concerning as the exclusion of significant changes in risk factors, as they involve different aspects of the risk register:
* Impacts are recorded in qualitative terms means that the risk register uses descriptive scales, such as low, medium, and high, to measure the potential consequences of the risks. This may not be as precise or consistent as quantitative measures, such as monetary values or percentages, but it does not necessarily affect the validity or usefulness of the risk register.
* Executive management does not perform periodic reviews means that the risk register is not regularly evaluated and updated by the senior leaders of the enterprise. This may indicate a lack of management commitment or oversight for risk management, but it does not directly affect the quality or completeness of the risk register.
* IT risk is not linked with IT assets means that the risk register does not associate the identified risks with the specific IT resources, such as hardware, software, data, or services, that are affected by or contribute to the risks. This may limit the visibility and traceability of the risks, but it does not necessarily affect the identification or assessment of the risks. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.2.2, pp. 21-22.