A significant risk to the company's online ordering capability has sat in the risk register for months without an owner, and no treatment decision has been made. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
A problem with no owner is a problem nobody's going to fix. You get it assigned to a business manager who can actually make the call and pay for it. The trap is security adopting the orphan itself, which feels responsible but puts the decision in the wrong hands.
Full Explanation
Every significant risk needs an owner who is accountable for deciding how it is treated and has the authority and resources to act. A risk to the online ordering capability belongs with the business manager responsible for that capability, who can weigh the risk against business objectives, fund treatment or accept the residual risk. The security manager should work through the risk governance structure, escalating to senior management or the risk committee if necessary, to get the risk formally assigned. Assigning the risk to the security team creates nominal accountability without authority over the business process or its budget, and it reinforces the misconception that security owns business risk. Implementing the strongest available control without an owner bypasses the decision process, may be disproportionate and still leaves nobody accountable for residual risk. Closing the risk until someone volunteers removes it from view, which is the opposite of managing it and could hide a significant exposure from management. Exam caveat: the governance framework should define how owners are assigned so that orphaned risks are escalated automatically. Operational check: confirm the risk now has a named business owner, a treatment decision with a due date, and that the register reports any risk without an owner to the risk committee.