Discuss Isaca CISM Exam Topic 2 Question 114

A recent application security assessment identified a number of low- and medium-level vulnerabilities. Which of the following stakeholders is responsible for deciding the appropriate risk treatment option?

ASecurity manager

BChief information security officer (CISO)

CSystem administrator

DBusiness owner

Suggested Answer: B

Verified Answer: According to the CISM Review Manual, 15th Edition, Chapter 3, Section 3.2.1.3, 'The appropriate risk treatment option is decided by the chief information security officer (CISO) or the designated risk owner.'1

The CISO is the senior executive who is responsible for overseeing and managing the information security program of an organization. The CISO has the authority and expertise to assess the risks, determine the risk appetite and tolerance levels, and select the most suitable risk treatment options for each risk. The CISO also has the accountability and responsibility for implementing, monitoring, and reporting on the risk treatment activities.

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Rikki 2 months ago

Security manager makes sense too. They handle security policies directly.

Isabelle 2 months ago

I disagree. The CISO has the expertise to assess risks properly.

Cassie 2 months ago

I think the business owner should decide. They understand the impact on the business.

Gerald 2 months ago

Really? I thought system admins had more say in risk management.

Zoila 2 months ago

Agreed, CISO makes the most sense here.

Therese 2 months ago

Wait, isn't it the security manager's job?

Quentin 3 months ago

I think the business owner has the final say.

Lourdes 3 months ago

Definitely the CISO should handle this!

Sharee 3 months ago

I’ve seen similar questions where the CISO was the right answer, but I wonder if it’s different when it comes to low- and medium-level vulnerabilities.

Marsha 3 months ago

I’m a bit confused about this one. The security manager seems like a logical choice, but I guess it depends on the organization's structure.

Florencia 3 months ago

I remember a practice question where the CISO was involved in risk decisions, but I feel like the business owner has the final say.

Terry 4 months ago

I think the business owner is usually the one who decides on risk treatment options, but I'm not entirely sure.

Isaca CISM Exam - Topic 2 Question 114 Discussion