Exam CRISC topic 1 question 888 discussion

The only answer that makes any sense is B

for C. since the question already highlights the weakness in data protection controls, simply reviewing the policies doesn’t directly mitigate the risk. I'm going with B

Agree with C. Without the stricture to "maintain flexibility" B would be my choice.

Going with B because the question is not about First thing to do: Option C, having the data privacy officer review the startup company's data protection policies, is important but may not be sufficient to mitigate the risks associated with weak data protection controls.

B. Classify and protect the data according to the parent company's internal standards. By classifying and protecting the data according to the parent company's internal standards, the acquiring company can ensure that the sensitive personal information is handled in a manner consistent with the regulations and security requirements that the parent company is subject to. This approach allows for the necessary data protection while still enabling the startup to operate with some degree of flexibility.

'A' doesn't make any sense. 'B' would be the most reasonable but it is the most rigid and does not answer the requirement for the newly created company. The policy review of the acquired company (which implies its adequacy) by the DPO is the 'least bad'.

Please note, the ask is about how to reduce the risk, not what to do first. Hence I will go with option A.

C is NOT the best answer as they already know about the weak data protection policy. D: is therefore the closest correct asnwer as they first want to know if there were any data breaches with the weak data protection policy. Weak is a qualitative measure. There is no threshold with respect to the policy.

I think answer A make more sense. Since two companies are merging, we already know weak controls in other company, so till we make other companies control level as parent company or as per regulatory requirement, we can isolate the other company and run as individual entity. options C and B may be next steps both will take time, we cannot stop other company business to stop till controls in place.

I think the Answer is Correct. makes sense to start by reviewing policy and then make an action plan.

D i mean not C

Correct Answer is C