Exam CISM topic 1 question 119 discussion

THE APPLICATION OWNER IS AT THE POSITION TO UNDERSTAND THE IMPACT, SO NOW RISK MITIGATION IS THE ONLY OPTION

If app owner is saying no, option C does not work. Senior management needs to make a decision.

According to the question, the mitigation exists , (Patch)..But the application owner is aware and will not install .. Seem Escalation is the next logical step..

C. Communicate the potential impact to the application owner. It's crucial to engage with the application owner and communicate the potential security risks and impact of not installing the necessary patches. This step allows for a collaborative discussion to find a solution that balances security and business continuity concerns. The application owner may not be fully aware of the security implications, so providing them with this information is essential. Depending on the outcome of this communication, further actions such as reporting to the information security steering committee, working with IT management on mitigation options, or escalating to senior management may be considered, but it's important to involve the relevant stakeholders first to reach a consensus and make an informed decision.

C. Communicate the potential impact to the application owner. It's crucial to engage with the application owner and communicate the potential security risks and impact of not installing the necessary patches. This step allows for a collaborative discussion to find a solution that balances security and business continuity concerns. The application owner may not be fully aware of the security implications, so providing them with this information is essential. Depending on the outcome of this communication, further actions such as reporting to the information security steering committee, working with IT management on mitigation options, or escalating to senior management may be considered, but it's important to involve the relevant stakeholders first to reach a consensus and make an informed decision.

You need to speak to the business owner but anyone else

Simple, in a real world, you talk to your colleagus first before esclation. Unless, you don't care the relationship at all, how possible?

B. Determine mitigation options with IT management.