CISM: Certified Information Security Manager

The business owner is responsible for accepting and directing treatment of the application’s business risk. Reporting the assessed vulnerability enables an authorized decision on remediation, compensating controls, risk acceptance, or operational interruption. A vulnerability alone does not necessarily require incident response or an immediate service shutdown.