Study. uk . com
  1. Home
  2. All questions
  3. Question 312

CISM study material · question 312 of 1000

An organisation deploys multi-factor authentication to reduce an access control risk and sees a rise in help desk load and user workarounds. Which point does IR 8286 make about risk responses?

  1. Responses should be reversed when any new risk appears
  2. Risk responses may themselves introduce new risks
  3. New risks arising from a control are outside the risk process
  4. A rise in support load indicates the control was misconfigured
Show the answer

Answer: B. Risk responses may themselves introduce new risks

IR 8286 notes risk responses themselves may introduce new risks, giving the example that adding multi-factor authentication to reduce an access control risk may introduce a risk of decreased productivity when users struggle with the technology.

Source: NIST IR 8286 (NIST) — Sec. 3.5 Plan and Execute Risk Response Strategies

Challenge yourself on this topic → Study as cards