Of the following, who is MOST appropriate to own the risk associated with the failure of a privileged access control?
Of the following, who is MOST appropriate to own the risk associated with the failure of a privileged access control?
The most appropriate person to own the risk associated with the failure of a privileged access control is the Business owner. Business owners are ultimately responsible for all aspects of their business processes, including the associated risks. Although the Information Security Manager may be responsible for implementing and maintaining security controls, the accountability for the impact on business operations due to failure in privileged access control lies with the business owner, making them the most suitable to own this risk.
These questions are always hard for me when accountable is not a word in the question. Hate to have to do this, but ISACA heavily states that the Business owner is always accountable for any risks . Since this question involves failure I am going to correlate own=accountable making the best answer C. I could be wrong, but here is my explanation of why I am going with C.
The most appropriate person to own the risk associated with the failure of a privileged access control is the B. Information security manager. The information security manager is responsible for implementing and maintaining controls related to access management and security. They are specifically trained and experienced in understanding and mitigating the risks associated with privileged access control. They have the knowledge and expertise to monitor and manage the systems, processes, and policies related to privileged access, ensuring that the appropriate measures are in place to protect sensitive information and prevent unauthorized access.
management and execution may be more for ISM, but "ownership" usually falls back on the business owner's side. also... GPT4o gives C. Yeah it's a weird one but they always throw us off with the damn wording.
C. Business owner
Per GPT4o, it is C. "The business owner is responsible for the processes and outcomes within their area of the organization. Since the failure of a privileged access control can significantly impact business operations, data integrity, and security, it is essential that the business owner, who has the authority and accountability for the affected area, owns the associated risk. " When you ask it questions, make sure to say "use CISM guidelines" for a more accurate answer.
B- ISM does not own any risk.
Tough one but B.
Its PAM