Certified Information Security Manager (CISM) — Question 969

Which of the following BEST illustrates residual risk within an organization?

Answer options

• A. Balanced scorecard
• B. Risk management framework
• C. Business impact analysis (BIA)
• D. Heat map

Correct answer: D

Explanation

A heat map visually depicts risk levels and residual risks remaining after mitigation efforts, making it the best choice for illustrating residual risk. The balanced scorecard, risk management framework, and business impact analysis do not focus specifically on the visualization of residual risk, hence they are not the best representations for this concept.