Exam CISM topic 1 question 192 discussion

If you don't have stakeholder input (business unit leaders, end users) how do you know the value to the assets when conducting risk assessments?

I'm going with D on this one. Periodic risk assessments help identify vulnerabilities that may threaten regular operations and, consequently, an organization's reputation. By improving the overall cybersecurity defense posture, protecting endpoint devices, and minimizing potential damage from specific threats, risk assessments play a crucial role in shaping and maintaining the resilience of information security programs. While establishing KPIs, obtaining stakeholder input, and understanding current and emerging technologies are essential components of an information security program, conducting periodic risk assessments provides the necessary context and intelligence to inform these activities, making it the cornerstone of a successful information security strategy.

B. Obtaining stakeholder input