An information security manager performs a gap analysis and discovers several information security program components missing. Which of the following should be done NEXT as a result of this finding?

The correct answer is C. Conduct a risk assessment. Discovering gaps tells you what is missing, but not how dangerous those gaps are. A risk assessment must come next to evaluate the likelihood and impact of each gap, enabling informed prioritization. Without this, creating an action plan (B) could focus resources on low-risk…

Submitted by chen.hong· Apr 18, 2026Information Security Risk Management

Question

Options

AUpdate the security architecture.
BCreate a security action plan.
CConduct a risk assessment.
DImplement additional controls.

How the community answered

(63 responses)

A
6% (4)
B
3% (2)
C
78% (49)
D
13% (8)

Explanation

Discovering gaps tells you what is missing, but not how dangerous those gaps are. A risk assessment must come next to evaluate the likelihood and impact of each gap, enabling informed prioritization. Without this, creating an action plan (B) could focus resources on low-risk gaps while ignoring critical ones. Implementing controls (D) without risk context is premature and potentially wasteful. Updating security architecture (A) is a downstream activity that should be guided by risk-informed decisions, not by the raw gap list alone.

Topics

#Gap analysis#Risk assessment process#Security program management#Control identification

Community Discussion

No community discussion yet for this question.

Full CISM Practice