MENU
An IT organization is replacing the customer relationship management (CRM) system. Who should own the risk associated with customer data leakage caused by insufficient IT security controls for the new system?
Suggested Answer: B
Get Premium CRISC Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
JA
Jackie
11 months ago
Not sure if the CISO can handle all the risks alone, though.
FL
Floyd
12 months ago
Wait, why would the IT Controls Manager be responsible? That seems off.
LA
Laurene
12 months ago
The Chief Risk Officer is usually the one who handles these issues.
HE
Herminia
12 months ago
I think the Business Process Owner should take responsibility here.
MI
Mila
1 year ago
Definitely the Chief Information Security Officer should own this risk.
JO
Josefa
1 year ago
I’m leaning towards the Chief Information Security Officer, but I wonder if the business process owner has more direct responsibility for customer data.
SH
Shoshana
1 year ago
The Chief Risk Officer seems like a logical choice, but I feel like the IT controls manager might have a role in this as well.
SA
Samira
1 year ago
I remember a practice question where the business process owner was held accountable for data integrity, so maybe they should be involved here too?
KA
Karma
1 year ago
I think the Chief Information Security Officer should own the risk since they're responsible for overall security, but I'm not entirely sure.
AB
Abel
1 year ago
Hmm, I'm not too sure about this one. I'll have to think it through carefully. Maybe I should review my notes on SAP applications for supply chain management.
LI
Linsey
1 year ago
Hmm, I'm a bit unsure about this one. I know external stakeholders are those outside the organization, but I'm not totally confident which of these options would qualify. I'll have to think it through carefully.
LA
Laura
1 year ago
This seems straightforward enough. I'll eliminate the options that are clearly not the cause of the issue, then focus on the remaining possibilities.