Exam CISM topic 1 question 430 discussion

C The information security manager's FIRST course of action should be to inform respective risk owners of the impact of exceptions. This is important because the risk owners are responsible for managing the risks associated with the security controls, and they need to be aware of any exceptions to their controls so that they can take appropriate action. Once the risk owners are informed, they can prioritize the risk and implement treatment options, design mitigating controls for the exceptions, and report the noncompliance to the board of directors as necessary. However, informing the risk owners should be the first step in addressing the issue.

Answer is C: effective risk management starts with communication and ownership so to ensure the right people understand the risks. in such way informed decisions can be taken.

C is correct as per giovi.

Correct me if I'm wrong, but wouldn't the risk owner's already be aware of the risk before accepting and hence, an exception is in place? I would vote D

This step is critical as it directly addresses the issue. By prioritizing the risks, the manager can identify which exceptions pose the greatest threat to the organization and address them first. Notifying respective risk owners is an important step, but it's not the first action to take. The immediate concern should be to mitigate the risks.

C. Inform respective risk owners of the impact of exceptions Before taking any further steps, it is important to notify the individuals or teams responsible for the risks associated with these exceptions. This helps ensure that all relevant stakeholders are aware of the issues and their potential impact on the organization's security posture. Once the risk owners are informed, you can then proceed to prioritize the risks (option A) and work with them to implement treatment options, and if necessary, design mitigating controls (option D). Reporting to the board of directors (option B) is typically done after the initial assessment and communication with the risk owners.

I would give the respective risk owners a call to inform them of the impact of the exception before designing mitigating controls.

C. Notify the risk owners. Maybe you dont need mitigating controls

I would give the respective risk owners a call to inform them of the impact of the exception before designing mitigating controls.

i vote....C. Inform respective risk owners of the impact of exceptions

I'm confused between C and D. Anyone please suggest which is the correct Option.

I don't like C for this but can't say it's not right. Part of the risk acceptance process would be to make sure the risk owner knows the impact of the exceptions. So why would you do this AGAIN? I think that D, design mitigating controls..., is the better answer, but not by much.