I85PREP
⌘ K
CISSO study materials
CISSO study resources

CISSO practice questions

One question at a time. Build your CISSO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Governance and Risk Management

In an information security governance framework, what is the primary purpose of a steering committee?

  1. To conduct penetration tests on production systems
  2. To configure firewalls and endpoint protection tools
  3. To perform daily log monitoring and incident triage
  4. To set strategic direction and prioritize security investments aligned with business objectives Correct answer.

Explanation

A security steering committee is a governance body that provides strategic oversight, aligns security initiatives with business goals, and approves priorities and funding. Operational tasks such as monitoring, tool configuration, and testing belong to execution teams, not governance.

Question 2Information Security Governance and Risk Management

Which document typically states management's commitment to information security and defines the overall direction and principles for protecting information assets?

  1. The asset inventory register
  2. The information security policy Correct answer.
  3. The change management procedure
  4. The disaster recovery plan

Explanation

The information security policy is a top-level management document that expresses commitment, sets direction, and establishes principles and responsibilities. Lower-level standards, procedures, and plans derive from and must be consistent with it.

Question 3Information Security Governance and Risk Management

An organization wants to compare its security practices against a recognized international standard to establish a management system for information security. Which framework is most appropriate?

  1. NIST Cybersecurity Framework
  2. COBIT 5 for Risk
  3. PCI DSS
  4. ISO/IEC 27001 Correct answer.

Explanation

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system, and it is certifiable. PCI DSS is payment-card specific, COBIT focuses on IT governance, and the NIST CSF is voluntary guidance rather than a certifiable management system standard.

Question 4Information Security Governance and Risk Management

What does the concept of risk appetite describe in an information security program?

  1. The list of vulnerabilities identified during the last scan
  2. The amount and type of risk an organization is willing to accept in pursuit of its objectives Correct answer.
  3. The percentage of budget allocated to security tools
  4. The maximum number of incidents the SOC can handle per shift

Explanation

Risk appetite expresses the level of risk an organization is prepared to accept to achieve its objectives, and it guides risk treatment decisions. It is distinct from operational capacity, vulnerability findings, or budget figures.

Question 5Information Security Governance and Risk Management

Which term describes the process of identifying, analyzing, and evaluating risk to determine which risks require treatment?

  1. Risk transfer
  2. Risk avoidance
  3. Risk monitoring
  4. Risk assessment Correct answer.

Explanation

Risk assessment is the overall process of risk identification, analysis, and evaluation that informs treatment decisions. Transfer, avoidance, and monitoring are treatment or follow-up options rather than the assessment process itself.

Question 6Information Security Governance and Risk Management

A security manager reports to the board that a critical system has an annualized loss expectancy of $200,000 and a proposed control costs $50,000 per year. Which conclusion is best supported by this quantitative analysis?

  1. The control should be rejected because it does not eliminate all risk
  2. The control is justified because its cost is lower than the expected annual loss it reduces Correct answer.
  3. The control should be deferred until the asset value increases
  4. The analysis is invalid because quantitative methods cannot address security risk

Explanation

When the annual cost of a control is less than the expected annual loss it mitigates, the control is generally cost-justified. Residual risk remains, but elimination of all risk is not the criterion for a sound treatment decision.

Question 7Information Security Governance and Risk Management

An organization purchases cyber insurance to cover potential financial losses from breaches. Which risk treatment option does this represent?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Insurance shifts the financial consequence of a risk to a third party, which is risk transfer. The underlying likelihood of an incident is not reduced, which distinguishes it from mitigation.

Question 8Information Security Governance and Risk Management

A risk register entry shows a high likelihood and high impact for an unpatched internet-facing server. Which action best reflects a risk-based prioritization approach?

  1. Patch all servers in the environment simultaneously regardless of exposure
  2. Disable the risk register entry once the server owner acknowledges it
  3. Remediate the exposed server first and track residual risk after patching Correct answer.
  4. Document the finding and revisit it during the next annual review

Explanation

Risk-based prioritization directs remediation to the highest-exposure, highest-impact findings first, then verifies residual risk. Mass simultaneous patching ignores risk differentiation and can introduce operational disruption.

Question 9Information Security Governance and Risk Management

Which statement correctly distinguishes a policy from a standard?

  1. A policy states high-level management intent, while a standard specifies mandatory requirements to support it Correct answer.
  2. A standard is approved by the board, while a policy is written by technicians
  3. A policy is optional guidance, while a standard is mandatory
  4. A policy describes technical configuration steps, while a standard lists job roles

Explanation

Policies express management intent and direction at a high level, whereas standards define specific, mandatory requirements that operationalize the policy. Procedures then describe step-by-step implementation.

Question 10Information Security Governance and Risk Management

An organization defines roles so that the person who approves access requests cannot also provision the accounts. Which governance principle does this illustrate?

  1. Separation of duties Correct answer.
  2. Need to know
  3. Defense in depth
  4. Least privilege

Explanation

Separation of duties divides a sensitive process among different people to prevent fraud and error by requiring collusion. Least privilege and need to know limit the scope of access, but they do not split approval from execution.

Question 11Information Security Governance and Risk Management

A company must comply with a regulation requiring security controls but has no prescribed implementation method. Which approach best demonstrates governance maturity?

  1. Map regulatory requirements to a recognized framework and track control coverage Correct answer.
  2. Delegate all compliance decisions to the IT operations team
  3. Implement controls only where auditors explicitly request evidence
  4. Adopt the strictest available control set regardless of business impact

Explanation

Mapping regulatory obligations to a recognized control framework lets the organization demonstrate coverage, avoid gaps, and manage change systematically. It also supports consistent evidence for audits.

Question 12Information Security Governance and Risk Management

What is the role of a data owner in a security governance program?

  1. To write firewall rules protecting the data center
  2. To configure database backups and restore procedures
  3. To classify data and approve access based on business value and sensitivity Correct answer.
  4. To perform vulnerability scans on the data repository

Explanation

Data owners are accountable for classifying information and making access decisions based on business need and sensitivity. Custodians or IT teams handle technical tasks such as backups, scanning, and firewall configuration.

Question 13Information Security Governance and Risk Management

An organization adopts a control framework and decides to accept the residual risk of a legacy application that cannot be patched. Who should formally approve this risk acceptance?

  1. The security analyst who discovered the vulnerability
  2. The vendor that supplied the application
  3. The business owner with authority over the affected process Correct answer.
  4. The application developer who wrote the code

Explanation

Risk acceptance must be approved by a party with accountability for the affected business process and authority to accept the consequences. Analysts and developers can recommend treatment but generally lack that accountability.

Question 14Information Security Governance and Risk Management

Which activity best demonstrates continuous monitoring within an information security management system?

  1. Reviewing the security policy once every five years
  2. Conducting a penetration test only after a breach occurs
  3. Performing a one-time gap assessment before certification
  4. Tracking key risk and control metrics on an ongoing basis with defined thresholds Correct answer.

Explanation

Continuous monitoring relies on recurring metrics, thresholds, and reporting so that control effectiveness and risk levels are tracked over time. One-time assessments and event-driven tests do not provide ongoing assurance.

Question 15Information Security Governance and Risk Management

A risk assessment identifies a threat with low likelihood but catastrophic impact. Which statement best reflects sound governance judgment?

  1. The risk must always be avoided regardless of business context
  2. The risk can be ignored because likelihood is low
  3. The risk should be transferred to the security team
  4. The risk should be evaluated against risk appetite, since impact alone may exceed tolerance Correct answer.

Explanation

Low-likelihood, high-impact risks require evaluation against the organization's risk appetite and tolerance, because catastrophic impact may warrant treatment even at low probability. Likelihood alone is not a sufficient basis for dismissal.

Question 16Information Security Governance and Risk Management

What is the primary function of an IT risk register?

  1. To document network topology diagrams
  2. To record identified risks, their owners, ratings, and treatment status for tracking Correct answer.
  3. To store user credentials for privileged accounts
  4. To list approved software for the organization

Explanation

A risk register is a governance tool that records identified risks along with ownership, assessment ratings, treatment decisions, and status. It supports prioritization, reporting, and accountability over time.

Question 17Information Security Governance and Risk Management

Which metric best indicates whether a security awareness program is influencing behavior rather than just attendance?

  1. The rate at which employees report suspected phishing messages Correct answer.
  2. The total hours of training content produced
  3. The number of employees who attended training sessions
  4. The number of training modules offered in the catalog

Explanation

Behavioral indicators such as phishing reporting rates and simulated-click rates show whether awareness translates into action. Attendance, catalog size, and content volume measure activity rather than effect.

Question 18Information Security Governance and Risk Management

An organization's board asks for assurance that security risks are managed within tolerance. Which reporting approach best serves this need?

  1. Reporting only the number of security tools deployed
  2. Sharing individual incident tickets with the board
  3. Presenting aggregated risk posture against defined appetite thresholds with trend data Correct answer.
  4. Providing raw vulnerability scan output for every system

Explanation

Boards need aggregated, trend-oriented reporting that shows whether risk remains within stated appetite, enabling oversight decisions. Raw technical data and tool counts do not convey risk posture or tolerance status.

Question 19Information Security Governance and Risk Management

An organization outsources a critical service to a vendor. Which governance action best addresses the associated third-party risk?

  1. Transfer all accountability for the service to the vendor
  2. Assume the vendor's security posture matches the organization's own controls
  3. Define security requirements in the contract and monitor vendor performance against them Correct answer.
  4. Rely solely on the vendor's marketing claims about certification

Explanation

Third-party risk is governed by specifying security obligations contractually and verifying performance through ongoing monitoring and assurance activities. Accountability for outsourced risk remains with the organization.

Question 20Information Security Governance and Risk Management

A business unit wants to adopt a new cloud service that stores regulated data. Which governance gate should be applied before approval?

  1. A review of the vendor's stock price and market share
  2. A decision by the vendor's account manager
  3. An informal agreement between the requester and the IT help desk
  4. A security and compliance review confirming the service meets data protection requirements Correct answer.

Explanation

New services handling regulated data should pass a formal security and compliance review that verifies controls, data handling, and regulatory fit before approval. This is a core governance gate for managing change and third-party risk.

Question 21Information Security Governance and Risk Management

An organization defines a risk tolerance boundary and finds a system operating beyond it. According to governance principles, what should happen next?

  1. The risk tolerance boundary should be raised to match the system
  2. The system should continue operating while the risk is documented
  3. A treatment plan with an owner and timeline should be established and escalation triggered Correct answer.
  4. The finding should be closed once the system owner is notified

Explanation

Operating beyond tolerance requires a defined treatment plan with accountability and escalation to appropriate management. Adjusting the threshold to fit the finding undermines the integrity of the risk framework.

Question 22Information Security Governance and Risk Management

Which situation best illustrates a conflict between regulatory compliance and effective risk management?

  1. A framework recommends periodic access reviews that the organization already performs
  2. A regulation requires encryption of data at rest, which also reduces breach impact
  3. A regulation mandates a specific legacy control that does not address the organization's most significant current threat Correct answer.
  4. A standard requires logging that supports incident detection

Explanation

Compliance can diverge from risk management when mandated controls target past threats rather than the organization's current risk profile. Governance requires meeting obligations while separately addressing the material risks not covered by regulation.

Question 23Information Security Governance and Risk Management

An organization applies the same control baseline to all business units regardless of their differing risk profiles. What is the most likely governance consequence?

  1. Risk is uniformly reduced across all units
  2. Compliance obligations are automatically satisfied
  3. Residual risk is eliminated in every unit
  4. Resources are misallocated, with over-control in low-risk areas and under-control in high-risk areas Correct answer.

Explanation

Uniform controls ignore differences in risk exposure, leading to disproportionate spending where risk is low and insufficient protection where risk is high. Risk-based tailoring directs resources to where they most reduce material risk.

Question 24Information Security Governance and Risk Management

A security leader must decide whether to fund a control that reduces a moderate risk versus one addressing a risk that could halt core operations. Which decision principle applies?

  1. Fund the control with the lowest implementation cost
  2. Prioritize the risk with the greatest potential business impact relative to appetite Correct answer.
  3. Defer both decisions until the next budget cycle
  4. Fund both equally to avoid appearing biased

Explanation

Governance decisions should prioritize risks by their potential business impact and relationship to risk appetite, not solely by cost. A risk that could halt core operations typically warrants priority over a moderate one.

Question 25Information Security Governance and Risk Management

An organization wants assurance that its governance program remains effective as the business changes. Which mechanism best provides this?

  1. A list of all security incidents from the past year
  2. A periodic independent review of the governance framework with management review of results Correct answer.
  3. A static policy document approved once at program inception
  4. An annual employee satisfaction survey about the security team

Explanation

Independent review combined with management review provides ongoing assurance that governance remains fit for purpose as business conditions evolve. Static documents and unrelated data do not test governance effectiveness.

Question 26Information Security Governance and Risk Management

Which document establishes management's intent for information security and is intentionally written in broad terms so it remains stable as technology changes?

  1. Security policy Correct answer.
  2. Configuration baseline
  3. Technical standard
  4. Procedure

Explanation

A policy states management intent and direction at a high level, so it changes rarely and does not name specific products or settings. Standards, baselines, and procedures translate that intent into mandatory specifics and step-by-step actions that change more often.

Question 27Information Security Governance and Risk Management

In a governance model, which group typically holds ultimate accountability for accepting enterprise information security risk?

  1. The board of directors Correct answer.
  2. The IT service desk
  3. The internal audit function
  4. The security operations team

Explanation

Ultimate accountability for enterprise risk acceptance rests with the board or equivalent governing body, which sets risk appetite and delegates execution. Operational, audit, and support functions inform or execute but do not own enterprise-level acceptance.

Question 28Information Security Governance and Risk Management

Which concept describes the level of risk an organization is willing to pursue or retain in order to meet its objectives?

  1. Risk capacity
  2. Risk appetite Correct answer.
  3. Residual risk
  4. Inherent risk

Explanation

Risk appetite is the amount and type of risk an organization is willing to pursue or retain, and it guides decisions about which risks to take. Residual risk is what remains after treatment, inherent risk exists before controls, and capacity is the maximum risk the organization could bear.

Question 29Information Security Governance and Risk Management

Which classification label typically carries the strictest handling requirements because unauthorized disclosure would cause severe harm?

  1. Internal use only
  2. Confidential
  3. Public
  4. Confidential with regulatory scope Correct answer.

Explanation

When a classification adds regulatory or contractual scope, handling requirements become stricter than ordinary confidential data because legal obligations and breach notification duties attach. Public and internal labels carry the lightest requirements, and plain confidential sits below the regulatory-scoped tier.

Question 30Information Security Governance and Risk Management

What is the main purpose of a security steering committee in an information security governance structure?

  1. Administering user accounts and access changes
  2. Performing technical penetration tests
  3. Writing firewall rule sets
  4. Prioritizing security investments and resolving cross-functional risk decisions Correct answer.

Explanation

A steering committee aligns security with business strategy by prioritizing investments and resolving decisions that span business units. Technical testing, access administration, and device configuration are operational execution activities delegated elsewhere.

Question 31Information Security Governance and Risk Management

Which term describes the process of comparing security program performance against a recognized framework to identify improvement areas?

  1. Gap analysis Correct answer.
  2. Change control
  3. Incident triage
  4. Vulnerability scanning

Explanation

A gap analysis compares the current state of controls or practices against a target framework or standard to reveal shortfalls. The other options are operational processes that detect incidents, find technical weaknesses, or manage changes, not program-level benchmarking.

Question 32Information Security Governance and Risk Management

Which statement best describes the relationship between an information security management system and its supporting policies?

  1. The management system is a single policy document.
  2. The management system provides the governed framework in which policies are created, maintained, and reviewed. Correct answer.
  3. Policies exist independently and need no management oversight.
  4. Policies replace the need for management review.

Explanation

An information security management system is the overall governed framework of processes, roles, and reviews, and policies are artifacts maintained within it. It is not a single document, and policies do not remove the need for oversight or review.

Question 33Information Security Governance and Risk Management

Which artifact records the decision, rationale, and approving authority when management chooses to live with an identified risk?

  1. Risk acceptance record Correct answer.
  2. Control test result
  3. Incident response plan
  4. Business impact analysis

Explanation

A risk acceptance record documents that an authorized party knowingly accepted a risk, including the rationale and any expiry or review date. The other artifacts support response, continuity planning, or control evaluation but do not capture acceptance decisions.

Question 34Information Security Governance and Risk Management

A regulator updates a data protection rule, and the security team must determine which internal documents need revision. Which governance action should occur first?

  1. Immediately purchase additional cyber insurance
  2. Perform a compliance impact assessment against the new requirement Correct answer.
  3. Commission a penetration test of the payment environment
  4. Disable all systems that process personal data

Explanation

A compliance impact assessment maps the new obligation to existing policies, controls, and processes so changes can be scoped and prioritized. Insurance, shutdowns, and testing do not identify what must change to meet the requirement and may be premature or disproportionate.

Question 35Information Security Governance and Risk Management

A risk assessment team cannot quantify likelihood precisely for a new technology. Which approach best supports a defensible governance decision?

  1. Delegate the decision to the technology vendor
  2. Exclude the risk from the register until data is available
  3. Use qualitative or semi-quantitative scales with documented rationale Correct answer.
  4. Assign the maximum rating to every uncertain risk

Explanation

Qualitative or semi-quantitative scales let the organization express risk consistently when hard data is missing, provided the rationale and assumptions are documented. Excluding the risk hides exposure, saturating ratings destroys prioritization, and vendors cannot accept risk on the organization's behalf.

Question 36Information Security Governance and Risk Management

A security manager wants a single view of the top risks facing the enterprise, including ownership and treatment status, for a quarterly executive review. Which artifact best serves this need?

  1. A vulnerability scan report
  2. A firewall configuration export
  3. An enterprise risk register Correct answer.
  4. A change advisory board log

Explanation

An enterprise risk register consolidates identified risks with owners, ratings, and treatment status, which is exactly what an executive review requires. Scan reports, change logs, and configuration exports are operational records that lack enterprise risk context and ownership.

Question 37Information Security Governance and Risk Management

A business unit proposes a new application that would store customer payment data. Which governance step should occur before development funding is approved?

  1. A security risk assessment and control requirements review Correct answer.
  2. A post-implementation audit
  3. A disaster recovery test
  4. A user acceptance test

Explanation

Security requirements and risk must be assessed during design so controls are built in rather than retrofitted. Post-implementation audits, recovery tests, and acceptance testing occur later in the lifecycle and cannot economically shape the design.

Question 38Information Security Governance and Risk Management

An organization's risk appetite statement says it will not tolerate regulatory violations, yet a legacy system cannot meet a new requirement within the deadline. Which action is most consistent with governance principles?

  1. Silently extend the deadline without documentation
  2. Reclassify the affected data to avoid the requirement
  3. Stop reporting the gap in risk dashboards
  4. Escalate the gap to accountable executives for a documented exception with a remediation plan Correct answer.

Explanation

When actual practice conflicts with stated appetite, the gap must be escalated to accountable leadership, who can approve a time-bound exception with remediation. Silent extensions, reclassification, and suppressed reporting undermine the integrity of the governance process.

Question 39Information Security Governance and Risk Management

Which control type is a mandatory annual security awareness training requirement for all staff?

  1. Preventive Correct answer.
  2. Corrective
  3. Detective
  4. Compensating

Explanation

Awareness training is preventive because it reduces the likelihood of human error and policy violation before an incident occurs. Detective controls identify events, corrective controls restore conditions after an event, and compensating controls substitute for a primary control.

Question 40Information Security Governance and Risk Management

A third-party processor will handle regulated data. Which contractual element most directly supports governance oversight of that relationship?

  1. A price escalation schedule
  2. Defined security obligations with audit or assurance rights Correct answer.
  3. An exclusivity provision
  4. A marketing co-branding clause

Explanation

Security obligations plus audit or assurance rights give the organization a mechanism to verify the processor's controls and enforce requirements. Commercial clauses about branding, pricing, and exclusivity do not create security accountability.

Question 41Information Security Governance and Risk Management

An organization wants to demonstrate that its security program meets a recognized international standard to customers and regulators. Which approach is most appropriate?

  1. Rely on the IT director's verbal assurance
  2. Adopt a vendor product's default configuration
  3. Obtain independent certification against a recognized management system standard Correct answer.
  4. Publish an internal self-assessment memo

Explanation

Independent certification against a recognized management system standard provides third-party validation that customers and regulators can rely on. Self-assessment memos, default configurations, and verbal assurances lack independent verification and recognized criteria.

Question 42Information Security Governance and Risk Management

Which practice best ensures that security policies remain relevant as the organization's technology and business model evolve?

  1. Approving policies once at creation and never revisiting them
  2. Limiting policy distribution to senior management
  3. Setting a fixed review cycle with assigned owners and triggered reviews after major change Correct answer.
  4. Delegating all policy content to the procurement team

Explanation

Scheduled reviews with clear ownership, plus event-driven reviews after significant change, keep policies aligned with reality. One-time approval, misplaced ownership, and restricted distribution all allow policies to drift from actual practice.

Question 43Information Security Governance and Risk Management

A risk treatment plan proposes to reduce likelihood through stronger authentication and to reduce impact through data encryption. Which statement best characterizes this plan?

  1. It combines controls targeting different components of risk. Correct answer.
  2. It transfers risk to a third party.
  3. It eliminates the risk entirely.
  4. It applies two preventive controls only.

Explanation

Likelihood and impact are separate components of risk, and the plan addresses each with a different control, which is a layered approach. Neither control alone eliminates risk, and no transfer to a third party is described.

Question 44Information Security Governance and Risk Management

Which situation most clearly indicates that a governance program lacks effective oversight of exceptions?

  1. Exceptions are reviewed quarterly by a risk committee
  2. Exceptions require a documented compensating control
  3. Exceptions are time-bound, approved by named authorities, and tracked to closure
  4. Exceptions are granted verbally and never recorded in the risk register Correct answer.

Explanation

Unrecorded verbal exceptions remove accountability, visibility, and any path to remediation, which signals a governance breakdown. Time-bound approvals, committee review, and required compensating controls are all signs of healthy exception management.

Question 45Information Security Governance and Risk Management

A security leader must justify a control investment to executives who care about business outcomes. Which framing is most aligned with governance expectations?

  1. Technical feature comparisons between competing products
  2. The number of alerts the tool generates
  3. Expected reduction in financial and operational exposure relative to cost Correct answer.
  4. The vendor's market share

Explanation

Executives govern by weighing risk reduction against cost, so expressing expected exposure reduction relative to investment supports the decision. Product features, alert volume, and vendor popularity do not convey business risk or value.

Question 46Information Security Governance and Risk Management

An auditor finds that a control is documented and operating, but the documented procedure no longer matches how staff actually perform the task. Which governance weakness does this reveal?

  1. Documentation drift between defined process and actual practice Correct answer.
  2. Insufficient insurance coverage
  3. The control is ineffective because documentation always reflects reality
  4. Excessive risk appetite

Explanation

When documented procedures diverge from actual practice, the organization cannot rely on its documentation for assurance, a condition known as documentation drift. Documentation is not automatically accurate, and the finding says nothing about appetite or insurance.

Question 47Information Security Governance and Risk Management

Two business units apply conflicting data handling rules to the same regulated dataset. Which governance mechanism most directly resolves this?

  1. Relying on individual employee judgment
  2. A single enterprise data classification scheme with defined handling requirements Correct answer.
  3. Allowing each unit to set its own rules
  4. Escalating every case to the service desk

Explanation

A unified classification scheme with defined handling requirements gives all units the same mandatory rules for the same data type. Unit-specific rules, service desk escalation, and individual judgment produce inconsistent protection for identical data.

Question 48Information Security Governance and Risk Management

A risk register shows that a mitigation project is behind schedule while the underlying exposure grows. Which governance response is most appropriate?

  1. Reassess and update the risk rating, then escalate the schedule slippage to accountable owners Correct answer.
  2. Leave the rating unchanged until the project completes
  3. Remove the risk from executive reporting to avoid alarm
  4. Close the risk because a project has been funded

Explanation

Risk ratings must reflect current exposure, so growing exposure with a slipping project requires reassessment and escalation to those accountable. Holding ratings static, closing risks because funding exists, and suppressing reporting all misrepresent the actual risk position.

Question 49Information Security Governance and Risk Management

An organization's board wants confidence that security risk decisions are being made consistently across regions with different regulatory regimes. Which approach best provides that confidence?

  1. Let each region define its own risk methodology without comparison
  2. Benchmark only against the strictest single regulation
  3. Adopt a common risk methodology with documented regional variances and consolidated reporting Correct answer.
  4. Rely on annual self-attestation from each regional manager alone

Explanation

A common methodology enables comparability, while documented variances preserve legitimate regional differences and consolidated reporting gives the board a coherent view. Independent methodologies, unverified self-attestation, and single-regulation benchmarking prevent consistent enterprise oversight.

Question 50Information Security Governance and Risk Management

A control framework requires segregation of duties, but a small team cannot fully separate roles. Which governance approach is most defensible?

  1. Assign all conflicting duties to one trusted administrator
  2. Ignore the requirement because the team is small
  3. Declare the requirement satisfied without evidence
  4. Document the constraint, apply compensating controls such as independent review, and record the residual risk Correct answer.

Explanation

When full separation is impractical, documented compensating controls and explicit acceptance of residual risk preserve accountability and oversight. Ignoring the requirement, concentrating duties, or claiming compliance without evidence all leave the risk unmanaged and unrecorded.