Which of the following processes has the goal to ensure that any change does not lead to reduced or compromised security? Response:

Change control management is the formal process that governs all modifications to an IT system or its environment. Its primary objective, especially from a security perspective, is to meticulously evaluate the security implications of every proposed change and ensure that only authorized, tested, and secure changes are deployed, thereby preventing unintended security vulnerabilities or degradation.

Security management is a broad discipline that encompasses all security activities, of which change control is a specific part, but it's not the process specifically focused on managing individual changes.

Configuration management focuses on maintaining the consistency of a system's configuration over time, including security baselines, but change control is the process that enables changes to that configuration in a controlled manner.

Risk management is the overarching process of identifying, assessing, and mitigating risks. While change control is a risk mitigation strategy for changes, it is not the umbrella term for managing all changes to security.