nerdexam
Isaca

CGEIT · Question #20

Which of the following MOST effectively demonstrates operational readiness to address information security risk issues?

The correct answer is D. Procedures have been established for assessing and mitigating information security risks.. Operational readiness to address information security risk issues is most effectively demonstrated by having established procedures for assessing and mitigating those risks.

Submitted by mike_84· Apr 18, 2026Risk Optimization

Question

Which of the following MOST effectively demonstrates operational readiness to address information security risk issues?

Options

  • AExecutive management has announced an information security risk initiative.
  • BIT management has communicated the need for information security risk management to the
  • CA policy has been communicated stating enterprise commitment and readiness to address
  • DProcedures have been established for assessing and mitigating information security risks.

How the community answered

(15 responses)
  • A
    7% (1)
  • B
    13% (2)
  • D
    80% (12)

Why each option

Operational readiness to address information security risk issues is most effectively demonstrated by having established procedures for assessing and mitigating those risks.

AExecutive management has announced an information security risk initiative.

An announcement from executive management indicates awareness and intent but does not demonstrate actual operational capabilities or readiness.

BIT management has communicated the need for information security risk management to the

Communicating the need for risk management is a good first step, but it does not equate to having the operational mechanisms in place to address risks.

CA policy has been communicated stating enterprise commitment and readiness to address

A communicated policy indicates commitment and intent, but policies alone do not prove operational readiness without the underlying procedures for execution.

DProcedures have been established for assessing and mitigating information security risks.Correct

Established procedures demonstrate operational readiness because they provide concrete, actionable steps and a framework for how the organization will actively assess, respond to, and mitigate information security risks in practice.

Concept tested: Information Security Operational Readiness

Source: https://www.isaca.org/resources/isaca-journal/issues/2012/volume-3/operational-readiness-assurance-through-risk-assessments

Topics

#information security risk#operational readiness#risk procedures#risk mitigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGEIT Practice