Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
In practice the strategy evaluates options against cost, effectiveness, residual risk, and constraints, then selects the most appropriate controls or treatments
According to ISACA frameworks like COBIT and Risk IT, a risk response strategy is formulated to bring inherent risk down to an acceptable level of residual risk (within the enterprise's risk tolerance). The act of moving risk from an unmanaged state to an acceptable state is fundamentally defined as threat reduction
Controls are implemented to reduce risks. Risks drive controls, it's not the other way around.