Which of the following is not a step in information security management?
A)Define the controls that the threats can impose.
B)Establish an information security policy.
C)Implement controls that address the risks.
D)Identify the threats that can attack the firm's information resources.

Question

Quizplus · Accepted Answer

Defining the controls that threats can impose is not a step in information security management. Instead, controls are implemented to mitigate risks, not defined by threats.

Which of the Following Is Not a Step in Information