Information security controls are designed by balancing the available budget against the organization's risk tolerance. This balance ensures that the controls are both cost-effective and aligned with the organization's capacity to accept or mitigate risks. Governance and compliance (A) and auditing and security (B) pertain to regulatory and monitoring aspects, while threats and vulnerabilities (D) are inputs to risk assessments rather than direct factors in control design.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit