Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Assess the extend of the risk in a first step (B). If the resulting risk is not acceptable, perform a gap analysis to assess the as-is state and the desired state. Doing so will show you what steps and resources are needed to close the gap.
B. Assess the risk to business operations
A gap analysis is conducted first to understand how near/far you are from audit/regulation/business goals. Then you assess associated risks. Identifying Inherent risk, then calculate residual risk (taking into account any mitigation that was identified during gap analysis and the org risk apetite). This then informs the remediation work/risk treatment plan.