Question

After implementing agreed mitigating controls for a critical customer-facing application, the information security manager reassesses the risk and finds the residual risk still exceeds the organization's documented risk appetite. The business unit insists the application must remain in production to meet revenue targets. What should the information security manager do NEXT?

Accepted Answer

Document the gap and escalate the residual risk to senior management (the risk owner) for a formal accept-or-fund decision

Answer

Accept the residual risk on behalf of the organization since the business has confirmed it is essential to operations

Answer

Immediately take the application offline until additional controls reduce risk within appetite

Answer

Purchase cyber insurance to transfer the excess residual risk and close the finding