Testing shows that a key control protecting payment card data has failed. Which response by the information security manager BEST addresses the failure?
Select an answer to reveal the explanation.
Short Explanation
When a car fails inspection, you don't just repaint it or keep driving back until someone passes it. You find out what's wrong, fix it and check you're safe to drive. The trap is swapping products before you know why it failed, because the cause might not be the product at all.
Full Explanation
A failed key control means the risk it was treating may now be above appetite, so the response must both fix the control and update the organization's understanding of risk. Root cause analysis establishes why the control failed, whether through design, configuration, process, people or changes in the environment, so that remediation addresses the actual cause and prevents recurrence. The risk owner then needs a reassessment of the resulting risk, interim compensating measures if exposure persists and a decision on treatment. Replacing the control with a different vendor's product assumes the product was the cause; if the failure stemmed from process or configuration, a new product would fail the same way at significant cost. Retesting until a pass is obtained manipulates the evidence rather than addressing the weakness, and provides false assurance to management. Recording the failure and closing the test leaves the issue unaddressed and the risk owner unaware of a material change. Exam caveat: where payment card data is involved, contractual or regulatory obligations may also require specific reporting, so the manager should check those obligations as part of the response. Operational check: confirm the finding has an owner, a documented root cause, a remediation date and a follow-up test, and that the risk register reflects the reassessed risk.