CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ961

Information Security Risk Management

When preventive controls are not feasible for adequately mitigating risk, which action is MOST important for the information security manager?

  • A Identifying unacceptable risk levels
  • B Assessing vulnerabilities
  • C Evaluating potential threats
  • D Managing the impact
Explanation

When prevention is not feasible, risk treatment must focus on reducing the severity of a realized incident through impact management, including response, recovery, and continuity measures.

Community Discussion

No comments yet. Be the first to start the discussion!