Study. uk . com
  1. Home
  2. All questions
  3. Question 315

CISM study material · question 315 of 1000

No cost-effective control can bring a particular risk within tolerance. Which response does IR 8286 identify, and what must be weighed alongside it?

  1. Mitigation, weighed against the purchase price of the control and the cost of operating it thereafter
  2. Transfer, weighed against the insurance premium
  3. Avoidance, weighed against the cost of the lost opportunity that avoidance entails
  4. Acceptance, weighed against the regulator's expectations
Show the answer

Answer: C. Avoidance, weighed against the cost of the lost opportunity that avoidance entails

IR 8286 puts avoidance forward where nothing affordable brings the risk down far enough, and asks that the opportunity given up by avoiding be priced into that decision.

Source: NIST IR 8286 (NIST) — Table 3 Response Types

Challenge yourself on this topic → Study as cards