A new regulation requires that senior leadership demonstrate accountability for cybersecurity risk decisions. The CISO now presents the top risks to the board each quarter, and the board formally approves the risk appetite. Which business-level risk consideration does this demonstrate?

Management oversight is leadership's active direction and accountability for risk. When the board receives regular reports on the most significant risks, questions them, and formally approves the organization's risk appetite, it is exercising oversight, and that evidence is what regulators increasingly expect to see. Oversight also connects to stakeholder involvement and to the regulatory and legal considerations listed in the same objective, because a regulatory requirement is what prompted the change. A business impact analysis identifies critical processes and the effects of their disruption to set recovery objectives; it is a specific analytical activity, not the governance relationship between the board and the security program. Risk transfer is a treatment that shifts financial consequences to another party, usually through insurance or contracts; nothing in the scenario moves any risk elsewhere. Residual risk is the risk remaining after controls; the board may well review residual levels, but the concept that describes the board's role in approving appetite and holding leadership accountable is oversight itself. Exam caveat: oversight is evidenced by records such as minutes, approved appetite statements, and reporting cadences, so documentation is part of the control. Operational check: confirm board minutes show the quarterly risk report, the approved appetite statement, and any decisions or actions the board directed.