Study. uk . com
  1. Home
  2. All questions
  3. Question 103

CompTIA Security+ study material · question 103 of 611

A board asks why it cannot act on the security team's quarterly report. The report lists control gaps by identifier. What is the underlying problem?

  1. It speaks in control language rather than business consequence
  2. Control identifiers may not be shared with a board
  3. The report should be delivered monthly
  4. The board requires a quantitative risk model
Show the answer

Answer: A. It speaks in control language rather than business consequence

Risk communication fails when the audience cannot connect the finding to an outcome they are accountable for.

Source: NIST CSWP 29 (NIST) — NIST CSF 2.0 § 5 Improving Cybersecurity Risk Communication and Integration

Challenge yourself on this topic → Study as cards