Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A. Obtain management approval for policy exception. The best course of action in this scenario is to "A. Obtain management approval for policy exception." If a business unit has decided to accept the risk of implementing software with weak password controls, it's important to document this decision and seek management approval for the exception to the organization's policy. This ensures that the decision is transparent, documented, and properly authorized.
Going with A.
It is A. They have accepted the risk - you do not develop an additional control once the risk is accepted.