Information Security Risk Management →hardMultiple Choice

CISM Information Security Risk Management Practice Question

An information security manager is reviewing the organization's risk register and notices that a risk related to unpatched software has been assigned a risk score of 9 (on a scale of 1-10) with a note that the risk is 'accepted' because patching would disrupt a critical production system. Which of the following should the manager do NEXT?

⚠ Common exam trap

The trap here is assuming that a high risk score automatically warrants escalation or immediate mitigation, without first confirming that the risk acceptance was properly authorized.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Verify that the risk acceptance is documented and approved by the appropriate business owner.

The next step is to verify that the risk acceptance is properly documented and approved by the business owner. Risk acceptance is a formal process that requires accountability. If the acceptance is not valid, the manager can then take appropriate action, such as proposing compensating controls or escalating. Verifying the process ensures that the organization's risk governance is upheld and that the decision to accept the risk was made at the correct level.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Verify that the risk acceptance is documented and approved by the appropriate business owner.
Why this is correct
Risk acceptance must be formally documented and approved by the business owner who has the authority to accept the risk on behalf of the organization. The information security manager should verify that this process was followed. If not, the acceptance is invalid and the risk remains unmanaged. This ensures accountability and alignment with the organization's risk appetite. The manager should not unilaterally change the risk treatment without proper authority.
✗
Immediately implement a compensating control such as network segmentation to reduce the risk.
Why it's wrong here
While compensating controls can reduce risk, implementing them without proper analysis and approval could introduce new risks or operational issues. The manager should first verify that the risk acceptance is legitimate. If the acceptance is invalid, then proposing a compensating control would be appropriate. However, taking immediate action without confirming the acceptance process bypasses governance and could conflict with business decisions.
✗
Update the risk register to reflect that the risk is mitigated by the acceptance decision.
Why it's wrong here
Accepting a risk does not mitigate it; the risk remains. Updating the register to say 'mitigated' would be inaccurate and could mislead decision-makers. The risk register should accurately reflect the risk treatment (acceptance) and any conditions. The manager should ensure the register correctly documents the acceptance and the rationale, but not mislabel it as mitigated.
✗
Escalate the risk to the board of directors because a score of 9 is unacceptable.
Why it's wrong here
Escalation to the board may be necessary if the risk acceptance was not approved at the right level or if it exceeds the organization's risk appetite. However, the manager should first verify the documentation and approval. Escalating without verifying could undermine the business owner's authority and create unnecessary conflict. The risk score alone does not determine the need for board escalation; the acceptance process and risk appetite are key.

Go deeper

CISM Information Security Risk Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question