Certbie
Log InSign Up
Question 1 of 30
GlobalTech Solutions, a multinational corporation operating in North America, Europe, and Asia, is seeking to align its information security risk management with its enterprise risk management (ERM) framework, guided by ISO 31000:2018. The company\'s CEO, Anya Sharma, recognizes that information security risks are not isolated but interconnected with other business risks, such as financial, operational, and strategic risks. Given the diverse legal and regulatory landscapes in which GlobalTech operates, how should Anya best approach the integration of information security risk management into the broader ERM framework to ensure comprehensive risk oversight and compliance across all regions, considering the principles outlined in ISO 31000:2018? Assume that a unified ERM system is desired to provide a consistent view of risk across the organization.
Establish a unified ERM system that integrates information security risk management, aligning with ISO 31000:2018 principles, while ensuring compliance with relevant legal and regulatory requirements across all operational regions.
Develop separate information security risk management frameworks for each region, based on local legal and regulatory requirements, and loosely coordinate these frameworks with the corporate ERM system to avoid conflicts.
Focus primarily on the financial risks associated with information security breaches, treating information security as a cost center and implementing only the minimum required controls to reduce expenses.
Outsource information security risk management to a third-party provider in each region, relying on their expertise to handle compliance and risk mitigation, without integrating these activities into the corporate ERM system.