Maturity Models:
* Maturity models provide a framework for assessing the development and optimization of processes within an organization.
* They typically range from ad hoc and immature processes to well-defined and continuously improving processes.
Assessing IT Process Improvement:
* Changes in the organization's position within a maturity model indicate that processes are becoming more mature, standardized, and optimized.
* Improvements in maturity levels reflect enhancements in process efficiency, effectiveness, and consistency.
Importance of Maturity Models:
* Provides a clear and structured approach to evaluate and benchmark process improvements.
* Helps senior management understand the progress and development of IT processes over time.
Comparing Other Indicators:
* Number of Security Exceptions: Useful for identifying issues but not a comprehensive measure of process improvement.
* Risk Register Changes: Reflects risk management activities but not overall process maturity.
* Number of Intrusions Detected: Indicates security effectiveness but not broader process improvements.
References:
* The CRISC Review Manual discusses the use of maturity models to assess and improve risk management capabilities and IT processes (CRISC Review Manual, Chapter 3: Risk Response and Mitigation, Section 3.6 Capability Maturity Models).

Section: Volume C
Explanation:
Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Phishing attacks are a type of to social engineering attack and are best defended by end-user awareness training.
Incorrect Answers:
A: An intrusion detection system does not protect against phishing attacks since phishing attacks usually do not have a particular pattern or unique signature.
B: Application hardening does not protect against phishing attacks since phishing attacks generally use e-mail as the attack vector, with the end-user as the vulnerable point, not the application.
D: Certain highly specialized spam filters can reduce the number of phishing e-mails that reach the inboxes of user, but they are not as effective in addressing phishing attack as end-user awareness.

Explanation/Reference:
Explanation:
The risk responses that do not exist up till then, should be included in the organization's lessons learned database so other project managers can use these responses in their project if relevant.
Incorrect Answers:
A: The responses are not in the project management plan, but in the risk response plan during the project and they'll be entered into the organization's lessons learned database.
B: The risk responses are included in the risk response plan, but after completing the project, they should be entered into the organization's lessons learned database.
D: If the new responses that were identified is only included in the project's risk register then it may not be shared with project managers working on some other project.