iSACA Cybersecurity Fundamentals Certification Practice Exam

Which type of risk approach is focused on compliance?

1. Ad hoc approach

2. Compliance-based approach

3. Risk-based approach

4. Strategic approach

The correct answer is: Compliance-based approach

The compliance-based approach is fundamentally centered on ensuring that an organization adheres to specified regulations, standards, and frameworks governing its operations and data handling. This approach emphasizes meeting legal and regulatory requirements, often driven by external mandates or industry standards. Organizations using this approach establish frameworks and controls geared specifically towards compliance, such as GDPR for data protection or PCI-DSS for payment card security. By focusing on compliance, such organizations effectively manage risk by ensuring that they meet minimum standards set forth by regulatory bodies, thus minimizing legal and financial repercussions associated with non-compliance. This approach is distinctly different from others. An ad hoc approach lacks structure and formal processes, often leading to reactive rather than proactive measures in risk management. The risk-based approach, while also essential, centers on identifying, assessing, and prioritizing risks based on their potential impact and likelihood, which may not always prioritize compliance as its primary focus. The strategic approach typically aligns risk management with the organization’s broader goals and objectives, but again doesn't specifically concentrate on compliance as its primary driver.