CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ15

VerifiedInformation Security Risk Management

A critical vulnerability is discovered on a server that hosts multiple applications owned by different business units. One business unit determines that its hosted application will not work with the patch applied and elects to accept the risk. What should the information security manager do NEXT?

Explanation

A risk that a business owner elects to accept must be formally documented and tracked in the risk register, including its owner and acceptance status. This preserves accountability and supports future review of the unpatched vulnerability.

Community Discussion

No comments yet. Be the first to start the discussion!