Which of the following should be done FIRST when management approves additional controls?

The correct answer is A. Perform a risk assessment. Performing a risk assessment first ensures that the approved controls are applied where they are most needed and prioritized according to actual risk exposure. Management approval grants authority to implement, but a risk assessment tells you which risks the controls must…

Submitted by joshua94· Apr 18, 2026Information Security Risk Management

Question

Options

APerform a risk assessment.
BDevelop an implementation strategy.
CSchedule the target end date for implementation activities.
DBudget the total cost of implementation activities.

How the community answered

(37 responses)

A
81% (30)
B
5% (2)
C
11% (4)
D
3% (1)

Explanation

Performing a risk assessment first ensures that the approved controls are applied where they are most needed and prioritized according to actual risk exposure. Management approval grants authority to implement, but a risk assessment tells you which risks the controls must address, their severity, and in what order implementation should proceed. Without this, implementation may be misdirected. Developing an implementation strategy (B), scheduling timelines (C), and budgeting (D) all depend on understanding the risk landscape that the assessment provides. The risk assessment is the analytical foundation for all subsequent planning activities.

Topics

#Risk Assessment#Control Implementation#Risk Management Process#Security Controls

Community Discussion

No community discussion yet for this question.

Full CISM Practice