Question

A newly implemented data loss prevention (DLP) control was deployed by the security engineering team to reduce the risk of confidential customer data leaving the organization. During a post-implementation review, the risk practitioner notes that no one has been formally designated as responsible for the ongoing operation, tuning, and monitoring of the DLP control. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Assign a control owner who is accountable for the ongoing operation and effectiveness of the DLP control

Answer

Escalate the gap to internal audit for inclusion in the next audit cycle

Answer

Add the DLP control to the risk register as a new emerging risk

Answer

Recommend decommissioning the DLP control until governance is clarified