Isaca
CISM · Question #878
Which of the following is the GREATEST concern with implementing all controls recommended by a security framework?
The correct answer is B. Negative return on investment (ROI). Implementing every recommended control can create unnecessary cost and complexity beyond what the organization’s risk profile and business needs justify, leading to a negative ROI from over-control rather than risk-based, targeted implementation.
Submitted by carlos_mx· Apr 18, 2026Information Security Risk Management
Question
Which of the following is the GREATEST concern with implementing all controls recommended by a security framework?
Options
- ALack of approval from senior management
- BNegative return on investment (ROI)
- CIncreased risk levels
- DIncreased time for implementation
How the community answered
(46 responses)- A17% (8)
- B70% (32)
- C4% (2)
- D9% (4)
Explanation
Implementing every recommended control can create unnecessary cost and complexity beyond what the organization’s risk profile and business needs justify, leading to a negative ROI from over-control rather than risk-based, targeted implementation.
Topics
#Security Controls#Cost-Benefit Analysis#Return on Investment (ROI)#Security Frameworks
Community Discussion
No community discussion yet for this question.