A large enterprise is implementing an information security policy exception process. The BEST way to ensure that security risk is properly addressed is to:

The fundamental principle of effective IT risk governance is that the business owns the risk. When an exception to a security policy is requested, it signifies a deviation from an established control, thereby introducing or increasing risk. The IT security function's role is to assess and articulate this risk, but the ultimate accountability lies with the owner of the business process or asset affected. The BEST way to ensure the risk is properly addressed is to obtain formal acceptance of the residual risk from the process owner. This confirms that the decision is based on business needs and that the accountable party has made an informed choice to operate with that level of risk.

B. Performing a penetration test is a technical assessment method; it does not constitute the governance process for managing and accepting risk from a policy exception.
C. While IT security approval is a necessary input for risk analysis, they do not own the business process or the associated risk; therefore, their approval alone is insufficient.
D. Benchmarking is a strategic activity used to develop or review the policy itself, not to manage the operational process of handling individual exceptions to that policy.

1. ISACA, CGEIT Review Manual, 8th Edition, 2020. Domain 2: IT Risk Management, Task Statement R1.4, "Ensure that IT risk is managed within the risk appetite and risk tolerance of the enterprise." This task requires that decisions to accept risk, such as through a policy exception, are made by accountable business owners.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018. APO12 Manage Risk, Practice APO12.06 "Respond to risk," details that risk response options (including risk acceptance) must be identified, evaluated, and approved by the relevant business risk owners.

3. ISACA, CGEIT Review Manual, 8th Edition, 2020. Domain 1: Governance of Enterprise IT, Task Statement G3.2, "Ensure that there are processes to identify the business owners of information and IT assets." This establishes the basis for assigning accountability for risk acceptance in processes like policy exceptions.