CRISC Question 207

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  B. The level of acceptable risk to the organization The MOST important consideration when determining controls necessary for a highly critical information system should be "B. The level of acceptable risk to the organization." The controls implemented for a highly critical information system should align with the organization's risk appetite and tolerance. It's crucial to assess and define what level of risk the organization is willing to accept for this critical system and its associated data and functionalities. While the other options (A. The number of vulnerabilities to the system, C. The organization's available budget, D. The number of threats to the system) are relevant factors in control selection, they should be considered in conjunction with the organization's risk tolerance. The level of acceptable risk sets the context for determining the appropriate controls to manage vulnerabilities, threats, and costs effectively.

• 1

  should be B

• Chose B3

  Agree.