An enterprise is planning to introduce a new product that involves geolocation tracking of customers. Which of the following is the BEST way to determine the associated risk?

Question

Options

• AConduct a third-party application penetration test to identify vulnerabilities.
• BConduct a business impact assessment (BIA)
• CEvaluate the control environment for the collected data.
• DRequire an annual privacy and security assessment.

• A
  3% (1)
• B
  80% (32)
• C
  5% (2)
• D
  13% (5)

Explanation

A Business Impact Assessment (BIA) evaluates the potential consequences of a new initiative - including privacy risks, legal exposure, reputational harm, and operational impact - providing a holistic risk picture before launch. This is the appropriate tool for assessing risk of a new product. Option A (penetration testing) identifies technical vulnerabilities in an existing system, not the broader business and privacy risk of a proposed product. Option C (evaluating the control environment) assumes controls already exist for data that hasn't been collected yet. Option D (annual assessments) is periodic and reactive, not suited for pre-launch risk determination. A BIA is forward-looking and aligns with due diligence before introducing a high-sensitivity capability like geolocation tracking.

No community discussion yet for this question.