Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I felt it is C, they are taking exceptions, which means they are going to accept the risks. What needs to be decided next is how often to review these exceptions.
B..If it's an exception that stakeholders should know the compensation controls so they could know the mitigation process for these risk .
Impact to risk profile and potential compesating controls are already communicated before exception approved. Review period is remaining and best option