Which of the following is the PRIMARY reason to avoid alerting certain users of an upcoming penetration test?

To determine the selection of controls required to meet business objectives, an information security manager should:

The department head of application development has decided to accept the risks identified in a recent assessment. No recommendations will be implemented, even though the recommendations are required by regulatory oversight. What should the information security manager do NEXT?

Risk scenarios simplify the risk assessment process by:

Which of the following is the PRIMARY responsibility of an information security manager in an organization that is implementing the use of company-owned mobile devices in its operations?