A.Manual vulnerability scanning processes

B.Risk-averse organizational risk appetite

C.Organizational reliance on third-party service providers

D.Inaccurate documentation of enterprise architecture (EA)

A.Well-documented and communicated escalation procedures

B.A robust risk aggregation tool set

C.Clearly defined roles and responsibilities

D.A well-established risk management committee

A.Application development is outsourced.

B.Source code is escrowed.

C.Application controls are manual.

D.Developers have access to production environment.

A.Job descriptions

B.RACI chart

C.Organizational chart

D.Skills matrix

A.Known vulnerabilities published by the asset developer

B.Cost of replacing the asset with a new asset providing similar services

C.Potential loss to tie business due to non-performance of the asset

D.Known emerging environmental threats