Question 96

Explanation

The correct answer: COBIT (Control Objectives for Information and Related Technology) is a framework designed by ISACA that is used for the governance and management of enterprise IT. It is aimed at bridging the gap between control requirements, technical issues, and business risks. This framework would be ideal if the organization wanted to focus on internal risk analysis as it provides a holistic approach to IT governance, focusing on areas like Risk Management, Strategic Alignment, and Value Delivery. The incorrect answers: ISO/IEC 27002 is an international standard used as a reference for controls when implementing an Information Security Management System, maintaining and improving it, based on the requirements of the ISO/IEC 27001 standard. It's more focused on information security than specifically on internal risk analysis. HIPAA (Health Insurance Portability and Accountability Act) is a United States legislation that provides data privacy and security provisions for safeguarding medical information. It's not a framework for IT governance or risk management, and it's specifically aimed at health care industry. NIST SP 800-53 is a publication that provides a catalog of security and privacy controls for all U.S. federal information systems except those related to national security. While it does contain controls related to risk management, it isn't specifically focused on internal risk analysis. Rather, it provides a more holistic view on securing federal information systems.