CGRC · Question #617
According to NIST SP 800-39, when an organization responds to risk by eliminating the activities or technologies that are the basis for the risk, that organization is Response:
The correct answer is B. avoiding the risk. According to NIST SP 800-39, when an organization eliminates the activities or technologies that are the root cause of a risk, it is practicing risk avoidance. This strategy completely removes the possibility of the risk occurring.
Question
According to NIST SP 800-39, when an organization responds to risk by eliminating the activities or technologies that are the basis for the risk, that organization is Response:
Options
- Aaccepting the risk.
- Bavoiding the risk.
- Ctransferring the risk.
- Dmitigating the risk.
How the community answered
(36 responses)- A3% (1)
- B89% (32)
- C3% (1)
- D6% (2)
Why each option
According to NIST SP 800-39, when an organization eliminates the activities or technologies that are the root cause of a risk, it is practicing risk avoidance. This strategy completely removes the possibility of the risk occurring.
Accepting the risk means deciding to take no action to reduce the risk, understanding the potential consequences.
Risk avoidance involves eliminating the specific activities, technologies, or business processes that are the source of an identified risk, thereby completely preventing the risk from occurring. By removing the basis for the risk, the organization chooses not to engage in or use the problematic element.
Transferring the risk involves shifting the responsibility or burden of a risk to another party, such as through insurance or outsourcing.
Mitigating the risk involves taking actions to reduce the likelihood of the risk occurring, the impact if it does, or both.
Concept tested: NIST Risk Response Strategies - Avoidance
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf
Topics
Community Discussion
No community discussion yet for this question.