CISM Question 90

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D2

  I choose D because since we already know the gap exists (inherent risk > acceptable risk), then there’s no need to assess the gap again. It's time to implement those appropriate controls.

• Chose C1

  Before taking any specific actions such as transferring risk (Option A), recommending avoidance of the business activity (Option B), or implementing controls (Option D), it's crucial to conduct a thorough assessment of the gap between the current inherent risk and the acceptable risk level. This involves evaluating the specific risks associated with the activity, understanding the potential impact on the organization, and determining the feasibility and effectiveness of various risk management strategies. Assessing the gap provides a foundation for making informed decisions and selecting the most appropriate risk mitigation measures.

• 2

  C. assess the gap between the current and acceptable level of risk. Assessing the gap between the current level of risk and the acceptable level of risk is the initial step in understanding the nature and magnitude of the risk exposure. This assessment will help the information security manager make informed decisions about how to proceed. Once the gap has been assessed, the information security manager can then consider various risk management options, such as implementing controls to mitigate the risk to an acceptable level (option D), transferring the risk to a third party (option A), or recommending that management avoid the business activity (option B). However, understanding the gap is essential before determining which risk management strategy is most appropriate for the specific situation.