nerdexam
(ISC)2

CGRC · Question #617

According to NIST SP 800-39, when an organization responds to risk by eliminating the activities or technologies that are the basis for the risk, that organization is Response:

The correct answer is B. avoiding the risk. According to NIST SP 800-39, when an organization eliminates the activities or technologies that are the root cause of a risk, it is practicing risk avoidance. This strategy completely removes the possibility of the risk occurring.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

According to NIST SP 800-39, when an organization responds to risk by eliminating the activities or technologies that are the basis for the risk, that organization is Response:

Options

  • Aaccepting the risk.
  • Bavoiding the risk.
  • Ctransferring the risk.
  • Dmitigating the risk.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    89% (32)
  • C
    3% (1)
  • D
    6% (2)

Why each option

According to NIST SP 800-39, when an organization eliminates the activities or technologies that are the root cause of a risk, it is practicing risk avoidance. This strategy completely removes the possibility of the risk occurring.

Aaccepting the risk.

Accepting the risk means deciding to take no action to reduce the risk, understanding the potential consequences.

Bavoiding the risk.Correct

Risk avoidance involves eliminating the specific activities, technologies, or business processes that are the source of an identified risk, thereby completely preventing the risk from occurring. By removing the basis for the risk, the organization chooses not to engage in or use the problematic element.

Ctransferring the risk.

Transferring the risk involves shifting the responsibility or burden of a risk to another party, such as through insurance or outsourcing.

Dmitigating the risk.

Mitigating the risk involves taking actions to reduce the likelihood of the risk occurring, the impact if it does, or both.

Concept tested: NIST Risk Response Strategies - Avoidance

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf

Topics

#Risk Management#Risk Response#NIST SP 800-39#Risk Avoidance

Community Discussion

No community discussion yet for this question.

Full CGRC Practice