Acceptable levels of information security risk should be determined by:

Acceptable levels of information security risk should be determined by:
A . legal counsel.
B . security management.
C . external auditors.
D . die steering committee.

View Answer

Answer: D

Explanation:

Senior management, represented in the steering committee, has ultimate responsibility for determining what levels of risk the organization is willing to assume. Legal counsel, the external auditors and security management are not in a position to make such a decision.