A new approval control added to the order process doubles processing time, and sales staff now use personal email to send orders around it. What is the BEST action for the information security manager?
Select an answer to reveal the explanation.
Short Explanation
If people climb the fence, ask why the gate is so hard to use before you build the fence higher. A control people dodge isn't protecting anything. The trap is punishment or blocking: you fix the bypass but not the reason for it, so they'll find another way.
Full Explanation
A control that imposes enough friction on a business process to cause routine bypass is failing in practice, and the bypass through personal email creates a larger risk than the one the control was meant to address. The best response is to work with the process owner to understand the requirement and redesign the control so it still meets its objective, for example with risk-based approvals, automation or thresholds, while restoring acceptable processing time. Disciplining staff addresses individual behavior but not the design flaw; the pressure that caused the bypass remains and is likely to produce other workarounds and resentment toward security. Blocking personal email closes one bypass route without addressing the reason for it, and it may disrupt legitimate business while staff look for another channel. Removing the control solves the friction but leaves the original risk untreated; dropping a control is a risk acceptance decision for the risk owner, not something to do because it is inconvenient. Exam caveat: CISM expects controls to balance security, cost and usability in support of business objectives, and recurring bypass is a strong signal of imbalance. Operational check: after the redesign, measure processing time and monitor for orders entering through unapproved channels to confirm the bypass has stopped.