A new risk has been identified in a high availability system. The BEST course of action is to:

The correct answer is A. evaluate and prioritize the identified risk.. Risk management follows a structured lifecycle. When a new risk is identified, the immediate next step is always to evaluate and prioritize it - assessing its likelihood, potential impact, and urgency. Only after this evaluation can informed decisions be made about treatment opti

Submitted by renata2k· Apr 18, 2026Information Security Risk Management

Question

Options

Aevaluate and prioritize the identified risk.
Bperform a cost-benefit analysis for mitigating controls.
Crecommend risk acceptance to the business owner.
Ddevelop and implement a plan to mitigate the identified risk.

How the community answered

(60 responses)

A
72% (43)
B
3% (2)
C
7% (4)
D
18% (11)

Explanation

Risk management follows a structured lifecycle. When a new risk is identified, the immediate next step is always to evaluate and prioritize it - assessing its likelihood, potential impact, and urgency. Only after this evaluation can informed decisions be made about treatment options. Jumping straight to cost-benefit analysis (B), acceptance (C), or mitigation (D) skips the critical step of understanding the risk's actual severity and how it ranks relative to other risks. Without evaluation and prioritization, any subsequent action could be misdirected or disproportionate.

Topics

#Risk Assessment#Risk Prioritization#Risk Management Process

Community Discussion

No community discussion yet for this question.

Full CISM Practice