When defining a set of security controls to mitigate a risk, which of the following actions MUST occur?

Question

Options

• AEach control's effectiveness must be evaluated individually.
• BEach control must completely mitigate the risk.
• CThe control set must adequately mitigate the risk.
• DThe control set must evenly divided the risk.

• A
  14% (4)
• B
  7% (2)
• C
  76% (22)
• D
  3% (1)

Explanation

When defining a set of security controls to mitigate a risk, the following action must occur: the control set must adequately mitigate the risk. This means that the control set must reduce the risk to an acceptable level, based on the risk appetite and tolerance of the organization. The control set must also be cost-effective, feasible, and aligned with the business objectives and requirements. The control set must not necessarily completely mitigate the risk, as this may not be possible or desirable, depending on the nature and impact of the risk. The control set must not necessarily evenly divide the risk, as this may not be optimal or efficient, depending on the distribution and correlation of the risk. Each control's effectiveness must be evaluated individually, but this is not the only action that must occur when defining a control set.

No community discussion yet for this question.