An organization is evaluating risk treatment options for an aging internal document repository that contains non-sensitive archived data. Due to budget constraints, the Chief Information Security Officer (CISO) decides not to implement costly security upgrades. Instead, the organization purchases a cyber insurance policy covering potential breach liabilities for the system and signs an official memorandum documenting approval of the operational risks associated with continuing system operation without further technical modifications. Which of the following risk response strategies are being directly implemented in this scenario? (Select TWO.)
- Risk TransferenceCevap
- Risk AcceptanceCevap
- CRisk Avoidance
- DRisk Mitigation
Cevap
The organization is implementing Risk Transference by purchasing a cyber insurance policy and Risk Acceptance by formally approving and documenting the decision to operate the system with its existing residual risk.
Purchasing a cyber insurance policy transfers financial liability to an insurance provider (Risk Transference), while explicitly choosing to operate the system as-is with senior management sign-off constitutes absorbing the risk (Risk Acceptance).
Adım Adım Çözüm
Anahtar Kavram
Distinguishing fundamental risk response strategies (Acceptance, Transference, Mitigation, Avoidance) in corporate risk management.