In violation of a policy prohibiting the use of cameras at the office, employees have been issued smartphones and tablet computers with enabled web…

The introduction of smartphones and tablets with enabled cameras creates a new, unassessed risk that directly conflicts with an existing security policy. The fundamental principle of information security management is to take a risk-based approach. Therefore, the information security manager's first priority is to conduct a risk assessment. This assessment will identify the specific threats (e.g., unauthorized photography of sensitive information, intellectual property theft), analyze the potential impact and likelihood, and provide the objective data needed to make an informed decision. The results will guide all subsequent actions, including whether to revise the policy, implement technical controls, or accept the risk.

A. Revise the policy.

Revising the policy without first understanding the associated risks is reactive and not based on informed decision-making. The risk assessment must precede any policy changes.

B. Perform a root cause analysis.

While important for long-term process improvement, investigating why the violation occurred is secondary to understanding and managing the immediate risk exposure the organization now faces.

D. Communicate the acceptable use policy.

Communicating a policy that is actively being contradicted by the issuance of company equipment is confusing, ineffective, and undermines the credibility of the security program.

1. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.3

Risk Assessment

p. 89. The manual states

"Risk assessment is the process of identifying

analyzing and evaluating risk... The results of the risk assessment process provide essential information for a risk response." This establishes that assessment is the foundational step that must be performed before deciding on a response

such as revising a policy (Option A) or other actions.

2. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.3.1

Risk Identification

p. 90. This section emphasizes that "Risk identification is the first and most critical step in the risk management process." The scenario presents a new situation (cameras in a previously camera-free environment)

which constitutes a new risk that must be formally identified and assessed first.

3. Peltier

T. R. (2013). Information Security Risk Analysis

Third Edition. Auerbach Publications. Chapter 3

"Getting Started: The Risk Assessment Kickoff

" pp. 29-30. This academic text outlines that a risk assessment is the initial

formal process initiated when changes in the environment occur (such as the introduction of new technology) to understand the security posture and potential for loss. This supports conducting the assessment as the first course of action. (DOI not typically available for full book editions

but it is a standard academic reference in the field).