312-50V10 · Question #785
Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some…
The correct answer is A. Accept the risk. When residual risk falls below the defined risk threshold, the most business-favorable decision is to accept the risk rather than invest further in controls. Accepting risk at this point avoids unnecessary cost while allowing the project to continue profitably.
Question
Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company application is 50%. Security staff has taken some measures and implemented the necessary controls. After that, another security risk assessment was performed showing that risk has decreased to 10%. The risk threshold for the application is 20%. Which of the following risk decisions will be the best for the project in terms of its successful continuation with the most business profit?
Options
- AAccept the risk
- BIntroduce more controls to bring risk to 0%
- CMitigate the risk
- DAvoid the risk
How the community answered
(22 responses)- A77% (17)
- B14% (3)
- C5% (1)
- D5% (1)
Why each option
When residual risk falls below the defined risk threshold, the most business-favorable decision is to accept the risk rather than invest further in controls. Accepting risk at this point avoids unnecessary cost while allowing the project to continue profitably.
The residual risk of 10% is already below the established risk threshold of 20%, meaning the risk is within acceptable organizational limits. Accepting the risk at this point is the most rational and cost-effective decision, as the controls implemented have achieved the desired risk reduction without halting business operations or incurring additional unnecessary expenditure.
Reducing risk to 0% is practically impossible and would require disproportionate investment in controls that far exceeds the value gained, harming business profitability.
Further mitigation is unnecessary because the residual risk of 10% already satisfies the threshold of 20%; additional controls would only add cost without proportional benefit.
Avoiding the risk would mean discontinuing the application or project entirely, which eliminates business value and profit rather than preserving it.
Concept tested: Risk acceptance decision when below risk threshold
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.