CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ66

Information Security Risk Management

Which of the following is the MOST important consideration when reporting risk-assessment results to senior management?

  • A The reports should include comparisons to industry benchmarks.
  • B The reports should be presented in business terms.
  • C The reports should use formal methodologies.
  • D The reports should include recommended controls.
Explanation

Risk-assessment results should be communicated in business terms so senior management can understand their effect on organizational objectives, make informed decisions, and prioritize resources. Technical details such as formal methodologies, benchmarks, and specific controls are secondary to clear business impact.

Community Discussion

No comments yet. Be the first to start the discussion!