A test finds a control gap that could interrupt a business service. Which next step best turns the result into an enterprise risk statement?
Answer
Describe the potential effect on the service and assign severity under the enterprise's risk approach
Explanation
### Why this is right
The assessment material says that gaps should be assessed and expressed as risks to the enterprise. The statement should explain potential impact and receive a severity rating based on the enterprise's risk approach.
### The concept
A test result is evidence of a condition at a point in time. It becomes a risk statement when the organization considers what harm that condition could cause. A potential impact should not be reported as a confirmed event. The resulting risk can then be tracked and assigned a management disposition.
### The other options
- **B. Record only the name of the scanner used**: the tool may be useful context, but it does not explain business impact.
- **C. Assume the service will be interrupted and report the assumption as fact**: risk describes potential harm, not a certain outcome.
- **D. Close the finding because a test is only a point-in-time activity**: testing's point-in-time nature is a reason for follow-up, not automatic closure.
### Terms
- **Risk statement**: a description connecting a condition to potential harm.
- **Severity**: an assessment of how serious a risk may be.
### Remember
State what could happen and why it matters, not just what tool found a gap.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free