Question

A risk practitioner is reviewing a remediation action where the IT team reports that a new privileged-access monitoring control has been fully deployed to close a high-rated finding. The finding owner has requested that the corresponding risk register entry be updated to 'closed.' Before agreeing to close the entry, what is the MOST important action the practitioner should take?

Accepted Answer

Verify through independent testing that the control is operating effectively as designed

Answer

Confirm that the control was implemented within the approved budget and timeline

Answer

Update the residual risk score to reflect the finding owner's assessment

Answer

Obtain sign-off from the IT team that deployment is complete