Each of twelve business units has a minor data-handling risk that is individually within the tolerance set for that unit. All twelve units depend on the same shared file-transfer platform. What should concern the information security manager MOST?
Select an answer to reveal the explanation.
Short Explanation
Twelve small leaks in the same pipe can flood the basement even if each one looks harmless on its own. When risks share a common dependency, you have to add them up at the enterprise level. The trap is judging each unit in isolation and missing the big picture.
Full Explanation
Individual risks that each fall within local tolerance can combine into an exposure that the enterprise would not accept, particularly when they share a common cause. Here twelve units depend on one file-transfer platform, so a single failure or compromise of that platform could trigger all twelve scenarios at once. The security manager should aggregate the risk at enterprise level, consider the concentration on the shared platform and compare the combined exposure with the enterprise risk appetite set by senior management. That may justify treatment at the platform level that no single unit would have funded. Differences in assessment time horizon are a methodology consistency issue worth fixing, but they do not create the concentration risk that the shared dependency does. Unrecorded acceptances are a documentation gap; even if every acceptance were recorded, the combined exposure could still exceed appetite. A possible software upgrade is a routine maintenance consideration and does not address the cumulative risk across units. Exam caveat: aggregation is a portfolio view that belongs to enterprise risk reporting, not to any single unit's register. Operational check: confirm the enterprise risk report groups risks by shared dependency and shows the combined exposure against appetite.