Question 149 - COBIT 2019 discussion

The threat landscape is a design factor that describes the types and levels of threats that an enterprise faces from internal and external sources that could compromise its information and technology assets. The threat landscape helps to determine the level of security and resilience that an enterprise needs to protect its information and technology assets from unauthorized access, use, disclosure, modification, destruction, or disruption. When tailoring a governance system for an enterprise, one of the most important factors to consider for an operating environment with a high compliance requirement is the threat landscape. The compliance requirement is another design factor that describes the extent and nature of laws, regulations, standards, guidelines, contracts, or agreements that an enterprise must comply with regarding its information and technology activities. The compliance requirement influences the level of control and assurance that an enterprise needs to demonstrate its adherence to the applicable rules and obligations.By considering the threat landscape in relation to the compliance requirement, an enterprise can ensure that its governance system is appropriate for its risk profile and context, and that it can effectively manage the potential impacts of threats on its compliance status34Reference:3: COBIT 2019 Design Guide: page 41-434: COBIT 2019 Design Guide: page 47-48