Exam CRISC topic 1 question 797 discussion

Agree with C.

Sorry 'C', reason: The IT department is responsible for managing and securing the technology infrastructure of an organization, but ultimately, it is the business unit that owns and operates the applications that run on that infrastructure. Therefore, the business unit is responsible for managing the risks associated with the applications they use. When a high-risk vulnerability is identified in an application, it is the responsibility of the business unit to assess the potential impact of the vulnerability on their operations, customers, and overall business objectives. Based on this assessment, the business unit should prioritize and allocate resources to remediate the vulnerability. The IT department can support the business unit in identifying and remediating vulnerabilities, but they do not have the knowledge or expertise to determine the business impact of a vulnerability. Therefore, the business unit must take ownership of the risk associated with the vulnerability and determine the appropriate course of action.

IT department that is responsible for managing the risk associated with that vulnerability. This includes identifying and assessing the vulnerability, implementing appropriate controls to mitigate the risk, and monitoring and managing the vulnerability over time.