Câu 310: Isaca Certified Information Security Manager

Which of the following is MOST important to ensure when considering exceptions to an information security policy?

1. A. Exceptions are approved by executive management.
2. B. Exceptions undergo regular review.
3. C. Exceptions reflect the organizational risk appetite. — đáp án hiện tại
4. D. Exceptions are based on data classification.