CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ10

VerifiedInformation Security Risk Management

An information security manager has determined that the organization does not comply with new legislation that will soon take effect. Which of the following is MOST important to consider when deciding which additional controls to implement?

Explanation

The cost of noncompliance captures the financial and business impact of failing to meet a legal obligation, such as regulatory penalties, legal exposure, operational restrictions, and reputational damage. It is therefore the key consideration when determining the necessary additional controls for impending legislation.

Community Discussion

No comments yet. Be the first to start the discussion!