A business unit head asks the information security manager to sign the risk acceptance for an unpatched vulnerability in the unit's sales system, saying security is the expert on the risk. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
The mechanic can tell you the brakes are worn, but it's your car and your call whether to keep driving. Security advises; the risk owner decides and signs. The trap is the expert grabbing the pen just because they understand the risk best.
Full Explanation
Risk acceptance is a business decision that must be made by the risk owner, the person accountable for the business process and with authority over the resources needed to treat the risk. The information security manager contributes expertise, explaining the likelihood, impact, options and consequences, but does not own the sales system's risk and should not sign for it. If the security manager signed, accountability would shift to a function that neither benefits from the system nor controls its budget, undermining governance. Signing because of expertise confuses advice with accountability. Refusing acceptance and mandating a patch oversteps the security manager's authority; the owner may have valid business reasons for a temporary acceptance, and the manager's job is to ensure the decision is informed and documented, escalating if it exceeds the owner's authority. Internal audit must remain independent of management decisions; signing an acceptance would compromise its ability to later evaluate the risk process. Exam caveat: if the risk exceeds the business unit head's acceptance authority, the decision escalates to a higher level, not to security. Operational check: confirm the acceptance form names the owner as signatory, records the security manager's advice and includes an expiry or review date.