Which of the following is MOST likely to result in unidentified cybersecurity risks?

The failure to identify and formalize roles and responsibilities for cybersecurity creates a fundamental gap in governance. Without clear ownership, there is no accountability for performing critical tasks, including the systematic identification, analysis, and evaluation of risks. This lack of accountability is the most direct cause of risks going unidentified, as essential risk management processes are likely to be neglected or overlooked. A well-defined governance structure ensures that risk identification is an assigned, continuous activity rather than an ad-hoc effort.

A. Lack of procedures and guidelines is a failure in execution, but risks may still be identified, albeit managed inconsistently.
C. Disclosure protocols are a component of incident response, which occurs after a risk has materialized, not during risk identification.
D. Recovery processes are part of business continuity and disaster recovery, focusing on responding to events, not identifying risks beforehand.

1. ISACA, Cybersecurity Audit Certificate Program Study Guide, 2022, Domain 1: Cybersecurity and Audit's Role, Section 1.2.1, "Cybersecurity Governance." This section emphasizes that establishing and maintaining a governance framework, which includes defining roles and responsibilities, is essential for overseeing the cybersecurity risk management function.

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives, 2018, APO01 Managed I&T Management Framework, states that a key practice is to "Define organizational structures, roles, and responsibilities," ensuring that all responsibilities, including risk management, are explicitly assigned.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer. Chapter 3 discusses the importance of structures, roles, and responsibilities as a primary enabler for effective IT governance and risk management.