ExamGecko
Question list
Search
Search

Question 346 - CISM discussion

Report
Export

Senior management has just accepted the risk of noncompliance with a new regulation What should the information security manager do NEX*P

A.
Report the decision to the compliance officer
Answers
A.
Report the decision to the compliance officer
B.
Update details within the risk register.
Answers
B.
Update details within the risk register.
C.
Reassess the organization's risk tolerance.
Answers
C.
Reassess the organization's risk tolerance.
D.
Assess the impact of the regulation.
Answers
D.
Assess the impact of the regulation.
Suggested answer: B

Explanation:

Updating details within the risk register is the next step for the information security manager to do after senior management has accepted the risk of noncompliance with a new regulation because it records and communicates the risk status, impact, and response strategy to the relevant stakeholders. Reporting the decision to the compliance officer is not the next step, but rather a possible subsequent step that involves informing and consulting with the compliance officer about the risk acceptance and its implications. Reassessing the organization's risk tolerance is not the next step, but rather a possible subsequent step that involves reviewing and adjusting the organization's risk appetite and thresholds based on the risk acceptance and its implications. Assessing the impact of the regulation is not the next step, but rather a previous step that involves analyzing and evaluating the potential consequences and likelihood of noncompliance with the regulation.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-6/how-to-measure-the-effectiveness-of-information-security-using-iso-27004 https://www.isaca.org/resources/isaca-journal/issues/2017/volume-3/how-to-measure-the-effectiveness-of-your-information-security-management-system

asked 01/10/2024
Andrey Scherbakov
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first