Exam CISM topic 1 question 43 discussion

The correct Answer is A B - Sending an alert doesn't help anyone understand the impact C - Sending recommendation without showing impact doesn't help anyone to understand the impact D - Updating the risk assessments in intervals doesn't show the overall impact. Risk is all about the impact and probability. The only one that addresses this is A

Including the impact of the risk as part of regular metrics allows senior management to receive ongoing, systematic information about the state of vulnerabilities in user workstations. By incorporating this information into regular metrics, senior management can better understand the potential consequences of unpatched software and make informed decisions about prioritizing and allocating resources to address the identified risk. While options like sending regular notifications directly to senior managers (option B), recommending the security steering committee conduct a review (option C), and updating the risk assessment at regular intervals (option D) may also be valuable actions, incorporating the impact into regular metrics provides a consistent and integrated approach to communicating the risk over time.

A. Include the impact of the risk as part of regular metrics.

A. Makes sense. Non sec folks typically don't have any idea what the impact of a vulnerability could be if exploited.