Question

A business unit has repeatedly renewed the same formal risk acceptance for a legacy application vulnerability every quarter for the past two years, each time citing budget constraints. The risk practitioner notices the cumulative exposure now regularly approaches the enterprise risk tolerance threshold. What should the risk practitioner recommend FIRST?

Accepted Answer

Escalate to management to reassess whether acceptance remains the appropriate response given the sustained exposure

Answer

Automatically approve the next acceptance renewal to avoid disrupting the business unit's operations

Answer

Transfer the risk to a cyber-insurance policy to eliminate the exposure

Answer

Remove the risk from the register since it has been formally accepted multiple times