Exam CISM topic 1 question 1015 discussion

I believe it is C if the review team discovered noncompliance and likely documented it in the report and risk register...

First C, if after applying compensating control, the risk is still above the acceptable level, then accept the risk and update the risk register.

update the risk register first and then track it on regular intervals.

Update the risk register first. This way you can better understand the risk and choose how to treat the risk (like with compensating controls).

A. Update the risk register. Updating the risk register is the initial action to document and track the identified risk associated with the critical legacy application. This involves recording the non-compliance with mandatory security requirements and assessing the potential impact and likelihood of the risk. Once the risk is documented, the organization can then proceed to determine the most appropriate risk treatment strategy. While options like recommending taking the application out of service (Option B), implementing compensating controls (Option C), and monitoring the application until it can be replaced (Option D) are potential risk treatment strategies, updating the risk register is the foundational step in the risk management process. It ensures that the organization has a clear record of the identified risk and can make informed decisions on how to address it.

C. Implement compensating controls.