Question

A business unit manager wants to continue using a legacy application that cannot support multi-factor authentication. The information security manager has documented that this creates a risk exceeding the organization's defined risk appetite. The manager insists the application is critical to revenue and asks the security team to simply accept the risk. What is the MOST appropriate action for the information security manager?

Accepted Answer

Escalate the risk to the appropriate business risk owner and senior management for a formal acceptance decision

Answer

Accept the risk on behalf of the organization since the security team owns all information security risks

Answer

Refuse to allow the application to remain in production until MFA is implemented

Answer

Transfer the risk to a cyber insurance policy to cover potential losses