CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ68

VerifiedInformation Security Risk Management

A penetration test of a new system has found several critical vulnerabilities that threaten the go-live date. The system owner asks the information security manager to approve an exception so the system can be implemented without remediating the vulnerabilities. Which of the following is the MOST appropriate course of action?

Explanation

A risk assessment establishes the business impact, likelihood, and resulting risk from the critical vulnerabilities. It provides the basis for determining whether remediation, compensating controls, or formally documented risk acceptance is appropriate.

Community Discussion

No comments yet. Be the first to start the discussion!