Question

A quantitative risk assessment for a legacy inventory system shows an annualized loss expectancy (ALE) of $40,000. The information security manager evaluates a proposed control that would reduce the ALE to $5,000 but costs $90,000 per year to operate. The system is scheduled for decommissioning in 18 months. Which risk response is the MOST appropriate for the security manager to recommend?

Accepted Answer

Formally accept the risk after documenting the analysis and obtaining sign-off from the risk owner

Answer

Implement the control immediately, since reducing the ALE is always the priority regardless of cost

Answer

Transfer the entire risk to a cyber insurance provider to eliminate the residual exposure

Answer

Avoid the risk by immediately shutting down the inventory system