Question

An information security manager notices that several individually low-rated risks across different business units all stem from the same unpatched legacy authentication service. Each business unit has independently accepted its portion of the risk as within its local tolerance. What should the security manager do FIRST?

Accepted Answer

Aggregate the related risks into a single enterprise-level risk scenario and reassess the combined impact

Answer

Override the business units' acceptance decisions and mandate immediate patching of the legacy service

Answer

Record each acceptance in the risk register and continue monitoring the individual risks separately

Answer

Transfer the aggregated exposure to a cyber insurance policy to cover potential losses