ITIL 4 Specialist Collaborate, Assure and ImproveDemo

By ITIL · Question Mode

QuestionQ120

Information Security Management

An information security manager has been informed that the IT security budget must be cut. The manager wants to apply the guiding principles “start where you are” and “keep it simple and practical” to lower costs.

What is the BEST action the manager can take to reduce costs?

  • A Assign security responsibilities to all employees so that the number of information security management specialists can be reduced
  • B Outsource the responsibility for security incident management to a third party to reduce the need for in-house security specialists
  • C Evaluate the organization's risk appetite and assess security risks to identify controls that are no longer needed
  • D Identify all controls required by the audit standard the organization uses, and eliminate controls that do not support these audits
Explanation

Security controls should be proportionate to the organization’s risk appetite and its current risk exposure. Reviewing existing controls against those risks identifies controls that no longer provide sufficient risk-reduction value and can be removed without basing security solely on staffing changes, outsourcing, or audit scope. ITIL’s guiding principles support using the current state as the starting point and eliminating unnecessary complexity while preserving value.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!