CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ43

VerifiedInformation Security Risk Management

A significant risk has been identified in a core business function. Budget limitations prevent effective remediation. Who is accountable for choosing the appropriate risk treatment?

Explanation

Senior management is accountable for selecting risk treatment because decisions to accept, transfer, avoid, or fund mitigation of significant business risk require organizational authority over priorities, resources, and risk appetite.

Community Discussion

No comments yet. Be the first to start the discussion!