A risk sits inside tolerance and the owner records the response as accept, then closes the entry and stops tracking it. Which part of the accept response has been dropped?

Question

Answer 1

Show the answer

Answer: B. Monitoring, which remains required even where no further action is needed

IR 8286 defines accept as accepting cybersecurity risk within tolerance levels, with no additional response action needed except for monitoring — so monitoring is part of acceptance, not an alternative to it.

Source: NIST IR 8286 (NIST) — Table 3 Response Types