Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
If the residual risk has already been calculated and confirmed to have increased, the business impact should have already been considered as part of that calculation. In this case, reassessing the business impact might not be necessary because it was already factored into the residual risk analysis.
B must assess something before briefing leadership.
CISM QA are not consistent. Some went to management first, but some action by ISM is taken first. What about the assessment comes with cost and time?? Why dont we just go to senior management first, telling them about the story. Later on, ask the Senior management for budget/time/OT/Resources to do the assessment. Assessments may not be done in just half an hour like patching the windows, but it may need all departments to get involved.