Exam CISM topic 1 question 656 discussion

The correct answer is (C) Implement compensating controls. The reason is that if the main controls don't work then we need a set of alternative controls. These would be the compensating controls by definition. Rationale: A. Accept the noncompliance is incorrect cause some action should be taken to reduce the risk as in option (C) B. Conduct a control assessment is incorrect cause the answer has stated what the outcome would be. D. Educate the noncompliant users is incorrect cause educating the user does nothing to address the risk like (C) would.

A business unit is not complying with a control implemented to mitigate risk because doing so impacts the ability to achieve business goals. Best answer is b. Assessment. We first need to check if the control was implemented correctly. If the control was done correctly as trained and recommended, compensation then is followed.

IMO answer is C. ISM should eventually assess control before to report to senior manager

C. Implement compensating controls. In cases where a control is impacting the ability to achieve business goals, it's important to find a balance between security and business objectives. Compensating controls are security measures or countermeasures that can be put in place to offset the risks associated with noncompliance with a primary control. They can help maintain an acceptable level of security while still allowing the business to achieve its goals.

C. Implement compensating controls.

Contol assessment to check if current controls align with business goals/objectives

After assessment they reported to Seniour Mngt. So C

BEST recommendation is C

at first, assessment,