Câu 8: ITIL 4 Practitioner Information Security Management

A board of a large organization is considering certification of the organization’s information security management system to an internal standard. The board expects the certification to help retain and attract customers and reach new markets. CISO and information security managers estimated the costs of certification and necessary preparations and think that some requirements of the standard are too expensive to meet compared to the risks they address. What is the BEST course of action for the organization in this situation?

1. A. The board should consider the costs of the certification together with the expected value for the organization — đáp án hiện tại
2. B. The board should cancel the certification project as the costs are not justified
3. C. The organization should adopt only those parts of the standard which are recommended by the CISO
4. D. The organization should delegate the certification project to an external consultant