(ISC)2 Certified in Cybersecurity Practice Exam

Which of the following aims to manage and control risks in an organizational context?

1. Risk Governance

2. Risk Evaluation

3. Risk Planning

4. Risk Treatment

The correct answer is: Risk Governance

The correct response focuses on the concept of risk governance, which involves the framework and processes that organizations use to identify, manage, and control risks. It encompasses the overall management approach to risk, establishing roles and responsibilities, policies, and procedures to ensure that risk management is integrated into the organization's culture and operations. Effective risk governance enables organizations to proactively address potential risks, ensuring that they align with their strategic objectives and comply with regulatory requirements. Risk evaluation, while important, is a specific process within the broader risk management framework. It focuses primarily on assessing the likelihood and impact of identified risks, rather than the overarching system that governs how those risks are managed. Similarly, risk planning deals with the processes involved in developing a strategy for responding to risks but does not encompass the governance aspect. Risk treatment, on the other hand, pertains to the options available for managing identified risks, such as avoidance, mitigation, transfer, or acceptance, without addressing the governance structure that supports these actions.