Question

What is the process described when Trina, a security practitioner, selects a security control product, and a manager must review and approve the purchase?

A) Risk assessment
B) Change management
C) Incident response
D) Security governance

Answer 1

The process is called Change Management, involving a review and approval of the security control product selected by the security practitioner before purchase.

Step-by-step explanation:

The process described when Trina, a security practitioner, selects a security control product, and a manager must review and approve the purchase, is best defined as Change Management (Option B). This process is critical for ensuring that any adjustments to an organization's security posture are analyzed, validated, and documented properly before implementation. It prevents unauthorized or poorly planned changes, which could potentially affect the security and operations of the business negatively. In Change Management, once the product is selected, it must pass through various levels of approval and review. The manager's role in this scenario is an essential part of the governance process to manage risks associated with the change.