Câu 103: Isaca Certified Information Security Manager

Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?

1. A. Develop a business case for funding remediation efforts.
2. B. Advise senior management to accept the risk of noncompliance.
3. C. Notify legal and internal audit of the noncompliant legacy application.
4. D. Assess the consequences of noncompliance against the cost of remediation. — đáp án hiện tại