CISM Question 86

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  accepting a risk can only be done after assessing its impact.

• Chose C1

  The scenario provided in the question indicates that senior management has already accepted the risk, which implies that an impact assessment has likely already been conducted as part of the decision-making process.

• Chose C2

  C. Update details within the risk register. Once senior management has accepted the risk of noncompliance with a new regulation, the Information Security Manager should document the decision within the risk register. The risk register is a tool used for tracking identified risks and their status, including what decision has been made regarding each risk. Updating the risk register will provide a formal record of the decision and ensure that there is clear documentation, which is essential for future review and audits. It also serves as a reference point for any related risk treatment or mitigation activities that may become necessary later. Reporting the decision to the compliance officer, reassessing the organization's risk tolerance, and assessing the impact of the regulation are actions that would typically occur before the acceptance of risk by senior management, not after.