The correct answer isBbecause when a business unit cannot fully implement a required security policy, the best way to manage the related risk is through anexception managementprocess. This allows the deviation to be formally reviewed, justified, approved by the appropriate authority, documented, and monitored with awareness of the resulting residual risk.
The other options are less appropriate:
A. Change managementcontrols how changes are introduced, but it does not formally manage policy deviations.
C. Configuration managementhelps maintain technical baselines, but it does not address acceptance of noncompliance with policy.
D. Incident managementis used after an event occurs, not for governing approved deviations from policy.
Exact Extracts supporting the answer:
“In the absence of a formal policy on personal devices in the workplace the risk practitioner should recommend implementing an exception process based on appropriate approvals.”
“The primary reason for initiating a policy-exception process is the risk being justified by the benefit.”
“When an enterprise wants to quickly implement a technical solution that deviates from the company’s policies the risk practitioner should recommend a risk assessment and subsequent implementation only if residual risk is accepted.”
“The BEST way to ensure appropriate mitigation occurs on identified information systems vulnerabilities is by assigning action plans with deadlines to responsible personnel.”
These extracts directly support that a formalexception managementprocess is the best mechanism for managing risk when policy cannot be fully implemented.
===========
