CISM Certified Information Security Manager – Question0032 - CISM Certified Information Security Manager

Acceptable levels of information security risk should be determined by:

A. legal counsel.
B. security management.
C. external auditors.
D. die steering committee.

Correct Answer: D

Explanation:

Explanation:
Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume. Legal counsel, the external auditors and security management are not in a position to make such a decision.