CISM Question 18

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  When developing a critical system that stores highly confidential data, the information security manager’s top responsibility is to ensure that residual risk — the risk remaining after controls are applied — is within the organization’s risk appetite.

• Chose D2

  Its D, because because we have more leeway with reducing residual risk. Residual risk is dependent is on risk appetitie, where as requirements are requirments. This is not a one or the other question, we will always try to reduce risk. But a product coming out the door has to meet requirements, we can always patch later, or use compensating controls for any discrephancies. Again, you try to reduce risk during development, but requirements must be met first.

• Chose A1

  I was leaning towards D before, but will meeting regulatory requirements alone address the unique risks of storing highly confidential data? I bet not