The information security manager has been notified of a new vulnerability that affects key data processing systems within the organization. Which of the following should be done FIRST?

The correct answer is A. Evaluate the risk. The first step is to evaluate the risk (likelihood and impact in the organization’s context). This determines prioritization and the appropriate response (e.g., compensating controls, patching timeline, escalation), and ensures actions are aligned with business risk.

Submitted by kev92· Apr 18, 2026Information Security Risk Management

Question

Options

AEvaluate the risk.
BConduct a penetration test.
CInform senior management.
DImplement compensating controls.

How the community answered

(39 responses)

A
82% (32)
B
3% (1)
C
10% (4)
D
5% (2)

Explanation

The first step is to evaluate the risk (likelihood and impact in the organization’s context). This determines prioritization and the appropriate response (e.g., compensating controls, patching timeline, escalation), and ensures actions are aligned with business risk.

Topics

#vulnerability management#risk assessment#risk evaluation#initial response

Community Discussion

No community discussion yet for this question.

Full CISM Practice