CRISC: Certified in Risk and Information Systems ControlDemo

Question

Senior management is considering whether to share confidential data with the organization’s business partners. What is the BEST report for a risk practitioner to submit to senior management?

A project plan for classification of the data.
B summary of data protection and privacy legislation.
C design of controls to encrypt the data to be shared.
D possible risk and suggested mitigation plans.

Explanation

Senior management needs a risk-based assessment of disclosing confidential data, along with practical mitigation options, to make an informed decision and determine whether the residual risk is acceptable. Data classification, applicable legislation, and encryption controls may contribute to that assessment but do not by themselves present the full risk and treatment decision.

CRISC: Certified in Risk and Information Systems ControlDemo

AstroTutor

Notes

Readiness

QuestionQ1655

Community Discussion