Câu 78: Isaca Certified Information Security Manager

An information security manager was informed that a planned penetration test could potentially disrupt some services. Which of the following should be the FIRST course of action?

1. A. Estimate the impact and inform the business owner. — đáp án hiện tại
2. B. Accept the risk and document it in the risk register.
3. C. Ensure the service owner is available during the penetration test.
4. D. Reschedule the activity during an approved maintenance window.