Study. uk . com
  1. Home
  2. All questions
  3. Question 322

CISM study material · question 322 of 1000

After treatment, residual risk remains above the acceptable level and further controls would cost more than the activity is worth to the business. Which option does IR 8286 point the risk owner toward?

  1. Accepting the residual risk as it stands
  2. Exploring ways to avoid the risk altogether
  3. Re-scoring the risk to bring it within tolerance
  4. Transferring the residual risk to a supplier
Show the answer

Answer: B. Exploring ways to avoid the risk altogether

IR 8286 has the owner first test whether residual risk can be reduced further; where responding would cost more than the activity is worth, it directs them toward avoiding the risk instead.

Source: NIST IR 8286 (NIST) — Sec. 3.5.2 Responding to Residual Risk

Challenge yourself on this topic → Study as cards