Home » Isaca » CISM » An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager’s FIRST course of action?

An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager’s FIRST course of action?

03/14/2021 – by Mod_GuideK 1

An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager’s FIRST course of action?
A. Report the noncompliance to the board of directors.
B. Inform respective risk owners of the impact of exceptions
C. Design mitigating controls for the exceptions.
D. Prioritize the risk and implement treatment options.

SHOW ANSWERS

Download Printable PDF. VALID exam to help you PASS.

One thought on “An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager’s FIRST course of action?”

Prince says:

08/27/2021 at 5:50 PM

Yes, should be “B”. Implementing mitigating controls happens after you talk to business owners and the management.

1
1

Reply

One thought on “An information security manager has observed multiple exceptions for a number of different security controls. Which of the following should be the information security manager’s FIRST course of action?”

Leave a Reply Cancel reply