Some organizations document the outcome of the control strategy for each information asset-threat pair in a(n)_____,which includes concrete tasks with accountability for each task being assigned to an organizational unit or to an individual.
A) risk management plan
B) control strategy
C) cost-benefit analysis
D) action plan

Question

Quizplus · Accepted Answer

An action plan is a detailed document that outlines the specific steps necessary to achieve a particular goal or objective. In the context of information security, an action plan defines the concrete tasks required to implement the control strategy for each information asset-threat pair. It assigns responsibility for each task to an organizational unit or an individual. This helps ensure that the control strategy is implemented effectively and efficiently. The other options are not as appropriate for describing this type of document. A risk management plan typically outlines the process for identifying, assessing, and mitigating risks. A control strategy defines the measures to be taken to mitigate or eliminate risks. A cost-benefit analysis evaluates the costs and benefits of different courses of action. Although it may inform the development of an action plan, it is not the same thing as an action plan.

Some Organizations Document the Outcome of the Control Strategy for Each