Section: MIXED QUESTIONS

Explanation
Although senior management should support and sponsor a risk analysis, the know-how and the management of the project will be with the security department. Quality management and the legal department will contribute to the project.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
More incidents being reported could be an indicator that the staff is paying more attention to security.
Employee signatures and training completion may or may not have anything to do with awareness levels.
The number of individuals trained may not indicate they are more aware. No recent security incidents do not reflect awareness levels, but may prompt further research to confirm.

Explanation/Reference:
Explanation:
A risk management program should minimize the amount of risk that cannot be otherwise eliminated or transferred; this is the residual risk to the organization. Quantifying overall risk is important but not as critical as the end result. Eliminating inherent risk is virtually impossible. Maximizing the sum of all ALEs is actually the opposite of what is desirable.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT