The management staff of an organization that does not have a dedicated security function decides to use its IT
manager to perform a security review. The MAIN job requirement in this arrangement is that the IT manager

A.
report risks in other departments.

B.
obtain support from other departments.

C.
report significant security risks.

D.
have knowledge of security standards.

Explanation:

The IT manager needs to report the security risks in the environment pursuant to the security review, including risks in the IT implementation. Choices A, B and D are important, but not the main responsibilities or job requirements.