Question

A financial services firm implemented multi-factor authentication and enhanced logging six months ago to mitigate the risk of unauthorized access to its customer portal. The risk owner now wants to confirm whether the risk response achieved its intended objective before reporting closure of the mitigation project to the risk committee. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Re-measure the residual risk level after the controls have been operating and compare it against the risk appetite

Answer

Update the risk register to mark the risk as fully mitigated based on the completed implementation

Answer

Transfer any remaining exposure to a cyber insurance policy to cover potential unauthorized access losses

Answer

Schedule the next control effectiveness test for 12 months out to align with the annual audit cycle