Question

A security manager identifies a critical vulnerability in a customer-facing application. The permanent fix requires a vendor patch that will not be available for four months, and the residual risk during that period exceeds the organization's risk appetite. Which action should the security manager take FIRST?

Accepted Answer

Implement compensating controls to reduce exposure until the vendor patch is available

Answer

Formally accept the risk for the four-month period and document the decision

Answer

Purchase additional cyber insurance to transfer the potential financial loss

Answer

Escalate to the board and request that the application be taken offline immediately