A compliance review shows that several business units are not following the organization's laptop encryption standard, citing performance concerns. What should the information security manager do NEXT?
Select an answer to reveal the explanation.
Short Explanation
Finding noncompliance is like finding a leak: you don't rip out the plumbing on your own, and you don't redraw the blueprint so the leak disappears. You tell the people who own the house what it could cost them and let them decide.
Full Explanation
Noncompliance with a security standard represents a risk that the business has not formally accepted. The information security manager's role is to make that risk visible in business terms to the owners of the affected assets and to senior management, so they can decide whether to remediate, approve a documented exception or address the performance concern. Reporting the risk impact, rather than the bare compliance gap, enables an informed decision and keeps accountability with the business. Blocking laptops immediately is a unilateral enforcement action that may halt business operations without management agreement; enforcement may follow, but only after the decision process. Revising the standard to match current practice lowers the protection level without analyzing whether the resulting risk is acceptable, and it treats the symptom as the requirement. A reminder and a recheck in a year leaves a known exposure untreated and ignores the stated performance concern, which suggests a real business obstacle. Exam caveat: the performance concern may justify a technical adjustment or a time-bound exception, but that is a decision for management informed by the security manager. Operational check: confirm the noncompliance is logged with its risk rating, owners and a decision date, and track it through to remediation or approved exception.