A city utility’s IRM desk learns that quarterly access reviews for SCADA admin accounts failed their last two control tests. How should that result affect the related cyber risk record?
Select an answer to reveal the explanation.
Short Explanation
Think of residual risk like a weather report after the umbrella ripped. When the control that was supposed to reduce exposure fails its tests, the leftover risk goes up—not stays flat. Link those failed compliance results so the risk record tells the truth until the fix lands.
Full Explanation
When quarterly access reviews for SCADA admin accounts fail consecutive control tests at a city utility, those ineffective results should link so residual risk rises to reflect weaker protection until remediation succeeds. Failed technical access controls on OT administration directly change the cyber risk posture for infrastructure serving the public. Leaving residual unchanged because failed tests supposedly matter only for audit workpapers fails by concept because control effectiveness is an input to residual, not a paperwork side channel. Deleting and recreating the risk after the next annual workshop fails by concept because destroying continuity hides interim exposure and delays action. Marking the risk Accepted immediately so failed tests vanish from dashboards fails by concept because acceptance is a governed decision, not a way to mute failed-control signals. Exam caveat: CIS-RC links ineffective control results into residual risk scoring rather than isolating failures from the risk record. Operational check: relate the failed SCADA access-review control tests to the cyber risk, recalculate or refresh residual, confirm residual increases or worsens versus the prior effective state, and open mitigation tasks.