CISM Question 180

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  I was in doubt between B and C at the end I select B because acceptable risk level (or risk appetite) is fundamentally driven by business impact. System criticality determines how essential a system, service, or asset is to core business operations, revenue generation, or regulatory compliancet instead C is incorrect because risk matrix is a visual/analytical tool used to categorize and map probability against impact. It helps display risk ratings, but it does not define the business threshold for acceptable risk itself.

• Chose C3

  A risk matrix will allow you to determine the acceptable risk, because it will categorize the risk and place it into your overall risk appetite. Thus you can determine whether the risk is acceptable from the matrix. System criticalities is a critical component of assessing impact. It helps you understand the potential damage, but it doesn't define the organization's tolerance for that impact. The system's criticality is plotted on the risk matrix to help make the final determination of what is acceptable.

• 2

  Is it just me, or do others think as well that the question itself is flawed? An acceptable risk level must be determined by the senior management with support of the information security manager for informed decision making. It is something much bigger than talking about a single IT asset or system as answer option B implies.