A compliance report for a financial services organization indicates a vulnerability remediation inhibitor due to a legacy system that cannot be patched because it lacks vendor support. Which communication approach is most appropriate?

Question

Accepted Answer

A. Document the risk as a formal exception with a compensating control plan and escalate to leadership for acceptance. When patching is not feasible (e.g., unsupported legacy systems), the appropriate approach is to document a formal exception, implement compensating controls (e.g., network isolation, monitoring), and escalate to leadership for formal risk acceptance. The CySA+ Reporting and Communication domain covers inhibitors to remediation and compliance reporting. Deleting findings or reclassifying vulnerabilities falsifies compliance records.

A compliance report for a financial services organization indicates a vulnerability remediation inhibitor due to a legacy system that cannot be patched because it lacks vendor support. Which communication approach is most appropriate?

Related Questions

Discussion