Câu 324: Isaca Certified in Risk and Information Systems Control

Which of the following is the MOST important consideration when determining whether to accept residual risk after security controls have been implemented on a critical system?

1. A. Cost of the information control system.
2. B. Cost versus benefit of additional mitigating controls. — đáp án hiện tại
3. C. Annualized loss expectancy (ALE) for the system.
4. D. Frequency of business impact.