Question

A retailer is evaluating a new feature that would let customers store full payment card data in their mobile app profiles to speed checkout. A risk assessment shows the feature would dramatically expand the cardholder data environment, sharply increase PCI DSS scope, and introduce residual risk that remains above appetite even after all proposed encryption and tokenization controls. Executive projections indicate the feature would add only marginal revenue. Which risk response should the risk practitioner recommend?

Accepted Answer

Avoid the risk by not implementing the feature as designed

Answer

Mitigate the risk by adding further layers of encryption and monitoring controls

Answer

Transfer the risk by purchasing additional cyber insurance coverage

Answer

Accept the residual risk since the feature supports business growth