ISACA · CISM
Risk treatment and exceptions
CISM · Lesson 7 of 20 · 48:46
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISACA CISM exam, on the 2026 exam content outline. In this lesson: the four risk treatment options and how to choose between them, residual risk and risk acceptance by the right owner, treatment plans, and a sound exception process. Includes three original practice questions, with Stonebridge Energy, a fictional energy supplier, as the example.
Preview the topics
- Stonebridge closes an old customer forum that it no longer needs, because attackers keep targeting it. Which risk treatment is this?
- After new controls are added, the residual risk of a billing fraud scenario is still above Stonebridge’s risk appetite. What should happen next?
- An old control system at a power station cannot install the latest security patches, and replacing it will take two years. What is the best approach?