Câu 36: Isaca Certified Information Security Manager

If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:

1. A. transfer risk to a third party to avoid cost of impact.
2. B. recommend that management avoid the business activity.
3. C. assess the gap between current and acceptable level of risk. — đáp án hiện tại
4. D. implement controls to mitigate the risk to an acceptable level.