Certified in Governance, Risk and Compliance

Certified in Governance, Risk and Compliance · free preview Question 1 of 8

During a design review for a identity program, a insurance carrier needs data protection. Which recommendation best supports "Security and Privacy Governance, Risk Management, and Compliance Program"?

Select controls only by tool availability instead of system scope and data sensitivity. This ignores a core requirement of the objective.

Treat compliance as a one-time checklist with no control owner or monitoring. This leaves avoidable risk for the scenario.

Skip documenting residual risk when a deadline is near. This weakens data protection and creates operational fragility.

Map controls to business risk, evidence requirements, compliance obligations, and accountable owners before approving or changing the system. Apply it to the identity program with documented validation.