Question

After implementing a new data loss prevention (DLP) solution, a risk analyst reassesses a data exfiltration scenario. The inherent risk was rated High. Following control implementation, the residual risk is rated Medium, but the organization's documented risk appetite for data exfiltration is Low. What should the risk analyst recommend as the MOST appropriate next step?

Accepted Answer

Escalate the residual risk to the risk owner for a treatment decision, as it exceeds the defined risk appetite

Answer

Accept the residual risk because a control has already been implemented and inherent risk was reduced

Answer

Remove the scenario from the risk register since the DLP solution addresses the identified vulnerability

Answer

Reclassify the inherent risk rating to Medium to align it with the newly measured residual risk