Section: Volume D

説明/参照:
Explanation:
リスク対応の優先順位付けとリスク対応計画の策定は、いくつかのパラメータによって影響を受けます。
リスクを許容範囲内に抑えるための対応コスト

リスクの重要性

対応を実施する能力

対応の有効性

対応の効率

誤った回答:
B: リスクを軽減するために必要な時間は、リスクの優先順位付けやリスク対応計画の策定には影響しません。プロジェクトの予定時間に影響します。

The organization's information security manager is responsible for IT security controls that are outsourced to an external service provider. The information security manager is accountable for ensuring that the security policies and standards of the organization are followed by the service provider, and that the security objectives and requirements are met. The information security manager is also responsible for monitoring and evaluating the security performance and compliance of the service provider, and for managing the security risks and incidents that may arise from the outsourcing arrangement. The organization's risk function, the service provider's IT management, and the service provider's information security manager are not responsible for IT security controls that are outsourced, as they have different roles and responsibilities in the outsourcing process. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 5, Section
5.2.1.2, page 2461
1: ISACA Certified in Risk and Information Systems Control (CRISC) Exam Guide, Answer to Question
651.