Isaca
CISM · Question #349
When designing security controls, it is MOST important to:
The correct answer is C. apply a risk-based approach. The most important factor when designing security controls is applying a risk-based approach. This ensures that controls are prioritized based on the level of risk they mitigate, focusing resources on the most critical threats and vulnerabilities to the organization.
Submitted by fernanda_arg· Apr 18, 2026Information Security Risk Management
Question
When designing security controls, it is MOST important to:
Options
- Afocus on preventive controls.
- Bapply technical controls for sensitive data.
- Capply a risk-based approach.
- Dconsider business impact analysis (BIA) results.
How the community answered
(32 responses)- A3% (1)
- C94% (30)
- D3% (1)
Explanation
The most important factor when designing security controls is applying a risk-based approach. This ensures that controls are prioritized based on the level of risk they mitigate, focusing resources on the most critical threats and vulnerabilities to the organization.
Topics
#Security Controls#Risk Management#Control Design#Risk-based Approach
Community Discussion
No community discussion yet for this question.