Question

Without prior approval, a training department enrolled the company in a free cloud-based collaboration site and invited employees to use it. Which of the
following is the BEST response of the information security manager?

A. Conduct a risk assessment and develop an impact analysis.
B. Update the risk register and review the information security strategy.
C. Report the activity to senior management.
D. Allow temporary use of the site and monitor for data leakage.

Correct Answer: A???? or C????? or ,,,,,,,,

Answer 1

C. Report the activity to senior management.

• Because they didn’t get any prior approval.
• So when the information security manager comes to know about it, he should first inform the senior management.
• Because the senior management is at a higher level than the information security manager.
• It is always better to consult our seniors and discuss them about the activities before making any decisions.
• The activities like developing an impact analysis after conducting a risk assessment, review the information security strategy after updating the risk register and allowing the temporary use of the site and monitor for data leakage should be done.
• But before all of that, what the security manager should do is he should first report it to the senior management.
• That is if the company does anything without the approval of the manager, then when the manager comes to know about it, he should first report it to the senior management.
• Any decision should take after consulting senior management.