Consulting with the business owner is the FIRST course of action that the information security manager should take to address the risk associated with a new third-party cloud application that will not meet organizational security requirements, because it helps to understand the business needs and expectations for using the application, and to communicate the security risks and implications. The information security manager and the business owner should work together to evaluate the trade-offs between the benefits and the risks of the application, and to determine the best course of action, such as modifying the requirements, finding an alternative solution, or accepting the risk.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 41: “The information security manager should consult with the business owners to understand their needs and expectations for using third-party services, and to communicate the security risks and implications.”
CISM Review Manual, 16th Edition, ISACA, 2020, p. 42: “The information security manager and the business owners should collaborate to evaluate the trade-offs between the benefits and the risks of using third-party services, and to determine the best course of action, such as modifying the requirements, finding an alternative solution, or accepting the risk.”
Best Practices to Manage Risks in the Cloud - ISACA: “The information security manager should work with the business owner to define the security requirements for the cloud service, such as data protection, access control, incident response, and compliance.”
