Study. uk . com
  1. Home
  2. All questions
  3. Question 266

CISM study material · question 266 of 1000

A board proposes eliminating all cybersecurity risk from the organisation's operations. How does IR 8286 characterise both extremes of this spectrum?

  1. Avoiding all risk may stifle innovation to the point of producing little value, while ignoring risk invites undesirable consequences
  2. Both extremes produce equivalent outcomes, since an organisation that avoids all risk and one that ignores it both end up with no usable strategy
  3. Avoiding all risk is the correct target for regulated organisations, because a supervisor will not accept a residual exposure at any level at all
  4. Ignoring risk is acceptable wherever insurance is in place, since the policy converts any consequence at all into a cost that the organisation has already budgeted for
Show the answer

Answer: A. Avoiding all risk may stifle innovation to the point of producing little value, while ignoring risk invites undesirable consequences

IR 8286 marks both ends as failures: chase zero risk and innovation and efficiency are choked until little value remains; deploy technology blind to risk and bad outcomes become more likely.

Source: NIST IR 8286 (NIST) — Sec. 2.3 The Gap Between CSRM Output and ERM Input

Challenge yourself on this topic → Study as cards