Remediation funds can close only one of two compliance gaps this quarter. One gap relates to a regulator that has been especially active in public enforcement; the other exposes a larger volume of sensitive data to a threat that is actively exploited. How should the security manager prioritize?
Select an answer to reveal the explanation.
Short Explanation
Loud doesn't mean dangerous. You weigh how bad each gap would hurt and how likely it is to bite, with regulatory penalties as one part of the impact, and the scenario's actively exploited, high-volume exposure tells you where that lands. The trap is letting headlines set your priorities.
Full Explanation
Limited resources must be directed to the gaps that represent the greatest risk to the organization. A risk-based approach considers the likelihood that each gap will be exploited or result in enforcement, and the impact if it does, including regulatory penalties, harm to customers, legal liability and reputational damage. In the scenario, one gap involves a larger volume of sensitive data exposed to an actively exploited threat, which signals both higher likelihood and higher impact. Prioritizing the regulator with the most publicized enforcement lets visibility substitute for analysis; enforcement activity is one factor in likelihood, not the whole risk picture. Choosing the cheapest gap to show quick progress optimizes for appearances and may leave the most serious exposure open. Following the order in an audit report treats list position as a priority ranking, which audit reports do not necessarily imply. Exam caveat: some regulators impose fixed deadlines that can elevate a gap's priority; those deadlines are inputs to the risk evaluation, not an override of it. Operational check: record both gaps in the risk register with likelihood and impact ratings, show the rationale for the funding decision to the risk owners, and document the residual risk accepted for the deferred gap.