A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network that cannot meet this policy. Onesystem will be upgraded in six months, and two are not expected to be upgraded or removed from the network. Which of the following processes should be followed?

Question

Accepted Answer

D. Provide a business justification for a risk exception A risk exception is the formal governance process for documenting a deliberate deviation from an established security policy when full compliance is not technically or operationally feasible. It requires a written business justification, management sign-off, and an auditable record that covers all non-compliant systems - including both the system pending upgrade and the two that will remain permanently non-compliant.

Answer

A. Establish a risk matrix A risk matrix is an assessment tool used to score and prioritize risks by likelihood and impact, not a process for obtaining policy exception approval for non-compliant systems.

Answer

B. Inherit the risk for six months Inheriting risk is the act of accepting risk transferred from a parent organization or external entity, not a mechanism for granting a time-limited policy exemption to internal non-compliant systems.

Answer

C. Provide a business justification to avoid the risk Risk avoidance means eliminating the source of the risk entirely by removing or replacing the asset, which is not possible for the two legacy applications that will not be upgraded or removed.

A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network that cannot meet this policy…

Question

Options

How the community answered

Why each option

Topics

Community Discussion