Exam CRISC topic 1 question 1028 discussion

regulations trumps everything else.

Agree with C. Laws and regulations could preclude the use of IoT or the collection of PII, so it takes precedence over security, which is definitely a big concern for IoT, but secondary in this case.

I am going with B: The PRIMARY consideration when assessing the risk of using Internet of Things (IoT) devices to collect and process personally identifiable information (PII) should be the security features and support. IoT devices are vulnerable to cyberattacks, which could lead to unauthorized access to sensitive information, including PII. Therefore, the security features and support of the IoT devices used to collect and process PII should be the primary consideration. This includes assessing whether the devices have built-in security features, such as encryption and authentication, and whether they receive regular security updates and patches. Additionally, it is important to consider the level of support available from the device manufacturer or service provider in the event of a security incident.