Study. uk . com
  1. Home
  2. All questions
  3. Question 311

CISM study material · question 311 of 1000

A team sets itself the objective of driving every recorded risk to zero. How does IR 8286 state the actual goal of risk response?

  1. To eliminate all risks rated moderate or above
  2. To transfer as much risk as possible to third parties who are better placed to carry it
  3. Holding risk in line with appetite or tolerance at the lowest reasonable cost
  4. To reduce every recorded risk by at least one severity level in each annual reporting year
Show the answer

Answer: C. Holding risk in line with appetite or tolerance at the lowest reasonable cost

IR 8286 aims risk management at alignment rather than elimination: risk held against appetite or tolerance, achieved as cheaply as the situation allows.

Source: NIST IR 8286 (NIST) — Sec. 3.5 Plan and Execute Risk Response Strategies

Challenge yourself on this topic → Study as cards