CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ414

Risk Response and Reporting

A risk practitioner observes an increasing trend of users emailing sensitive information without encryption. Which of the following is the MOST effective approach for mitigating the risk of data loss?

  • A Implement a tool to create and distributive violation reports
  • B Block unencrypted outgoing emails which contain sensitive data
  • C Implement a progressive disciplinary process for email violations
  • D Raise awareness of encryption requirements for sensitive data
Explanation

Blocking outbound unencrypted emails that contain sensitive data is a preventive control that directly prevents the risky transmission and resulting data exposure. Awareness, disciplinary processes, and violation reports may improve compliance but cannot reliably stop an unencrypted message from being sent.

Community Discussion

No comments yet. Be the first to start the discussion!