A large enterprise is implementing an information security policy exception process. The BEST way to ensure that security risk is properly addressed…

The fundamental principle of effective IT risk governance is that the business owns the risk. When an exception to a security policy is requested, it signifies a deviation from an established control, thereby introducing or increasing risk. The IT security function's role is to assess and articulate this risk, but the ultimate accountability lies with the owner of the business process or asset affected. The BEST way to ensure the risk is properly addressed is to obtain formal acceptance of the residual risk from the process owner. This confirms that the decision is based on business needs and that the accountable party has made an informed choice to operate with that level of risk.

B. Performing a penetration test is a technical assessment method; it does not constitute the governance process for managing and accepting risk from a policy exception.

C. While IT security approval is a necessary input for risk analysis, they do not own the business process or the associated risk; therefore, their approval alone is insufficient.

D. Benchmarking is a strategic activity used to develop or review the policy itself, not to manage the operational process of handling individual exceptions to that policy.

1. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 2: IT Risk Management

Task Statement R1.4

"Ensure that IT risk is managed within the risk appetite and risk tolerance of the enterprise." This task requires that decisions to accept risk

such as through a policy exception

are made by accountable business owners.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. APO12 Manage Risk

Practice APO12.06 "Respond to risk

" details that risk response options (including risk acceptance) must be identified

evaluated

and approved by the relevant business risk owners.

3. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 1: Governance of Enterprise IT

Task Statement G3.2

"Ensure that there are processes to identify the business owners of information and IT assets." This establishes the basis for assigning accountability for risk acceptance in processes like policy exceptions.