CISM · Question #66
The MOST effective way to present information security risk to senior management is to highlight:
The correct answer is A. business impact. Senior management communicates in terms of business outcomes-revenue, reputation, compliance, and continuity. Framing security risk as business impact (financial loss, regulatory penalties, reputational damage, operational disruption) speaks directly to their decision-making…
Question
The MOST effective way to present information security risk to senior management is to highlight:
Options
- Abusiness impact.
- Bcountermeasures.
- Cthreat intelligence.
- Drisk mitigation over time.
How the community answered
(26 responses)- A88% (23)
- B4% (1)
- C8% (2)
Explanation
Senior management communicates in terms of business outcomes-revenue, reputation, compliance, and continuity. Framing security risk as business impact (financial loss, regulatory penalties, reputational damage, operational disruption) speaks directly to their decision-making context. Countermeasures (B) are technical solutions they don't need to evaluate. Threat intelligence (C) is operational detail without business translation. Risk mitigation over time (D) is useful but secondary-management first needs to understand why they should care, which is defined by business impact.
Topics
Community Discussion
No community discussion yet for this question.