Exam CISM topic 1 question 117 discussion

B. You can not go to senior management without information (Asses the business impact)

If the residual risk has already been calculated and confirmed to have increased, the business impact should have already been considered as part of that calculation. In this case, reassessing the business impact might not be necessary because it was already factored into the residual risk analysis.

B must assess something before briefing leadership.

CISM QA are not consistent. Some went to management first, but some action by ISM is taken first. What about the assessment comes with cost and time?? Why dont we just go to senior management first, telling them about the story. Later on, ask the Senior management for budget/time/OT/Resources to do the assessment. Assessments may not be done in just half an hour like patching the windows, but it may need all departments to get involved.

Assess the impact and then inform management. What could you really tell them if don't know the implications of the new level of risk?

Would say D. First inform and record the risk and get acceptance. If not, provide options for mitigation woth price tag.

B. Assess the business impact.