Exam CISM topic 1 question 1047 discussion

A risk assessment provides a comprehensive view of potential threats, vulnerabilities, and the associated impacts on the business. It helps prioritize risks and justifies the need for a technical solution by outlining the potential consequences of inaction. While the other options (BIA, vulnerability scan results, and penetration test results) provide valuable information, they are more focused on specific aspects rather than the overall risk profile, which is crucial for a business case.

Risk assessment output

C- Business case is prepared by ISM and Risk Assessment is ISM's best approach, therefore, C.

I would go with A here. The senior management would not require to see the vulnerability results, they would be more interested in how the business might get impacted if the vulnerabilities are exploited and what is the loss going to be. Vulnerability scan report on a business case is going to play light, however if we can show them how these vulnerabilities may affect the business, that will be playing hard.

Vulnerability scan results