Question

A financial services firm has identified that a single perimeter firewall is the only control protecting a customer database containing sensitive PII. A risk assessment rates the residual risk as high, and management has decided to mitigate rather than accept it. The information security manager is asked to recommend the mitigation approach. Which recommendation BEST reduces the residual risk?

Accepted Answer

Implement layered controls such as network segmentation, database encryption, and access monitoring in addition to the firewall

Answer

Purchase a cyber insurance policy sized to cover the potential breach loss

Answer

Upgrade the existing perimeter firewall to a next-generation model with more advanced rule capabilities

Answer

Document formal acceptance of the residual risk by the database business owner