A Chief Information Security Officer (CISO) has decided the cost to protect an asset is greater than the cost of losing the asset. Which of the following risk management principles is the CISO…

Risk acceptance occurs when an organization acknowledges a risk but chooses not to take action to reduce or eliminate it, often because the cost of protection exceeds the potential loss from the risk event, making it an economically justifiable choice.

Risk avoidance involves eliminating the risk entirely, often by discontinuing the activity or process that introduces the risk.

Risk transfer involves shifting the financial burden or responsibility of a risk to a third party, typically through mechanisms like insurance or outsourcing.

Risk mitigation involves taking steps to reduce the likelihood or impact of a risk, such as implementing security controls or establishing recovery plans.