Which of the following is the BEST strategy when determining an organization's approach to risk treatment?

The correct answer is B. Prioritizing controls that directly mitigate the organization's most critical risks. The best strategy for risk treatment is to prioritize controls that address the most critical risks, ensuring resources are focused where they will have the greatest impact on reducing the organization’s overall risk exposure.

Submitted by andres_qro· Apr 18, 2026Information Security Risk Management

Question

Which of the following is the BEST strategy when determining an organization’s approach to risk treatment?

Options

AImplementing risk mitigation controls that are considered quick wins
BPrioritizing controls that directly mitigate the organization's most critical risks
CAdvancing the maturity of existing controls based on risk tolerance
DImplementing a one-size-fits-all set of controls across all organizational units

How the community answered

(30 responses)

A
17% (5)
B
47% (14)
C
7% (2)
D
30% (9)

Explanation

The best strategy for risk treatment is to prioritize controls that address the most critical risks, ensuring resources are focused where they will have the greatest impact on reducing the organization’s overall risk exposure.

Topics

#Risk Treatment#Risk Prioritization#Critical Risks

Community Discussion

No community discussion yet for this question.

Full CISM Practice