Section: Volume D

Policies and standards are the primary documents that define the organization's expectations and requirements for information security and risk management. They provide the basis for establishing controls, procedures, roles, and responsibilities. Policies and standards should be updated following a change in legislation requiring notification to individuals impacted by data breaches, to ensure compliance with the new legal obligations and to align with the organization's risk appetite and tolerance. Updating policies and standards can also help to communicate the changes to the relevant stakeholders and to provide guidance for implementing and monitoring the controls. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.2, p. 28-29

The most helpful action to ensure the effective implementation of a new cybersecurity program is assigning clear ownership of the program. Here's why:
* Clear Ownership:
* Assigning clear ownership ensures that there is accountability and responsibility for the implementation and success of the program.
* The program owner will coordinate activities, allocate resources, and monitor progress to ensure that objectives are met.
* Creating Metrics:
* While metrics are important for monitoring and reporting, they do not directly ensure the effective implementation of the program.
* Hiring Subject Matter Experts:
* Subject matter experts are valuable for providing insights and guidance, but without clear ownership, their efforts may not be effectively coordinated or aligned with program goals.
* Establishing a Budget:
* A budget is necessary for securing resources, but it must be managed and directed by a responsible owner to ensure the effective use of those resources.
* References:
* The CRISC Review Manual discusses the importance of assigning roles and responsibilities, including ownership, to ensure the effective implementation of risk management programs (CRISC Review Manual, Chapter 1: Governance, Section 1.2.1 RACI).

A compensating control is a temporary or alternative control that is implemented when the primary control for mitigating a risk is not feasible or available. A compensating control should provide a similar level of protection and assurance as the primary control, and should be aligned with the risk appetite and tolerance of the organization. The risk practitioner's best course of action when a compensating control needs to be applied is to obtain the risk owner's approval. The risk owner is the person who has the authority and accountability for managing a specific risk, and who is responsible for ensuring that the risk is within the acceptable level.
The risk practitioner should consult with the risk owner to explain the situation, propose the compensating control, and seek their approval before implementing it. This way, the risk practitioner can ensure that the compensating control is appropriate, effective, and acceptable for the risk owner, and that the risk owner is aware of and agrees with the change in the risk treatment. The other options are not the best course of action, as they do not involve the risk owner's approval or input. Recording the risk as accepted in the risk register implies that the risk is not treated or reduced, which may not be the case with a compensating control.
Informing senior management may be a good practice, but it does not ensure that the risk owner is involved or agrees with the compensating control. Updating the risk response plan may be a necessary step after implementing the compensating control, but it does not require the risk owner's approval or consultation.
References = 5 Key Risk Mitigation Strategies (With Examples), Risk Management 101: Process, Examples, Strategies