CISM Question 282

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 2

  D. Level of residual risk Residual risk is the risk that remains after risk mitigation or treatment measures have been applied. Comparing the level of residual risk with the organization's risk appetite helps determine whether the remaining risk is acceptable or if further treatment measures are needed to bring it in line with the organization's risk tolerance.

• 1

  D. Level of residual risk

• Chose D11

  D. Level of residual risk. When informing a risk treatment decision, the information security manager should compare the level of residual risk with the organization's risk appetite. Residual risk is the risk that remains after risk treatment has been applied. By comparing the level of residual risk to the organization's risk appetite, the information security manager can determine if the risk is acceptable or if additional treatment is required. The organization's risk appetite is a statement of the level of risk that the organization is willing to tolerate and accept. By understanding the residual risk, the information security manager can make informed decisions on risk treatment options and prioritize them accordingly. It is important to note that other factors such as gap analysis results, level of risk treatment and configuration parameters are important to consider, but they don't provide a clear picture of the risk level that the organization is willing to accept.