The business owns its risk

Exam

CISM

What it means

The information security manager advises and reports; the business owner accepts or treats the risk. Options where security accepts business risk on someone's behalf are traps.

The trap answer looks like

The security manager accepts the risk, signs off the project or blocks the business decision.

The winning answer looks like

Security assesses and advises; the accountable business owner decides and accepts.

Worked example

A project manager asks the CISO to sign off that a system's risks are acceptable.

✅ Give the risk assessment to the business owner, who decides

The CISO advising is right. The CISO accepting is a trap.