Question

During a risk assessment, a CRISC practitioner identifies that a legacy financial application cannot support multifactor authentication due to technical constraints. The vendor has confirmed no patch or upgrade is available for at least 18 months. Management refuses to decommission the system because it supports a critical revenue process. What should the practitioner recommend FIRST to address the identified control deficiency?

Accepted Answer

Evaluate and implement compensating controls to reduce the residual risk to an acceptable level

Answer

Accept the risk formally and document it in the risk register until the vendor provides an upgrade

Answer

Escalate to the board to mandate immediate decommissioning of the legacy application

Answer

Reclassify the vulnerability as a false positive since no vendor fix exists