The individual accountable for managing threats and vulnerabilities related to a risk, and for reassessing the residual risk, is known as

• A. Risk Manager
• B. Security Architect
• C. Owner (Risk)
• D. Compliance Officer

Answer: (C)

The important idea is who is accountable for a specific risk. The person who owns a risk is responsible for managing the threats and vulnerabilities that could affect that risk and for re-evaluating the residual risk after controls are applied. This role, often called the risk owner, has the authority to decide on risk responses, ensure appropriate mitigations are put in place, and monitor how the risk posture changes over time. They are typically a business unit or process owner with the authority and resources to take action and to accept or escalate risk within tolerance.

Other roles play critical parts, but they don’t carry the same level of ownership for a particular risk. A risk manager coordinates risk activities across the program; a security architect focuses on designing security controls; a compliance officer ensures policies and regulations are followed. None of these roles, by themselves, holds the accountability for a specific risk and its residual risk in the way the risk owner does.