The best control to prevent the inappropriate disclosure of confidential information when print jobs containing confidential information are sent to a shared network printer located in a secure room is to require a printer access code for each user. A printer access code is a unique and secret code that the user needs to enter on the printer device to release and retrieve the print job. Requiring a printer access code for each user is the best control, as it helps to prevent or limit the unauthorized access, viewing, or copying of the confidential information on the print job, especially if the print job is left unattended or forgotten on the printer device.
Requiring a printer access code for each user also helps to ensure the accountability and traceability of the user who sent the print job, and to support the audit and monitoring of the printer activity. Using physical controls to access the printer room, using video surveillance in the printer room, and ensuring printer parameters are properly configured are also useful controls, but they are not as effective as requiring a printer access code for each user, as they do not directly prevent or limit the inappropriate disclosure of confidential information on the print job, and they may not deter or detect the unauthorized access or misuse of the print job by the authorized users who have access to the printer room or device. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

Section: Volume D

Section: Volume A
Explanation:
The enterprise with risk management capability maturity level 0 makes decisions without having much knowledge about the risk credible information. In level 1, enterprise takes decisions on the basis of risk credible information.
Incorrect Answers:
A, C, D: An enterprise's risk management capability maturity level is 1 when:
* There is an understanding that risk is important and needs to be managed, but it is viewed as a technical issue and the business primarily considers the downside of IT risk.
* Any risk identification criteria vary widely across the enterprise.
* Risk appetite and tolerance are applied only during episodic risk assessments.
* Enterprise risk policies and standards are incomplete and/or reflect only external requirements and lack defensible rationale and enforcement mechanisms.
* Risk management skills exist on an ad hoc basis, but are not actively developed.
* Ad hoc inventories of controls that are unrelated to risk are dispersed across desktop applications.