Question

A security team identifies a residual risk in a legacy application that cannot be cost-effectively remediated before a critical product launch. The estimated impact is within the organization's documented risk appetite, and no compensating control is feasible in the timeframe. According to sound risk management practice, what is the MOST appropriate next step?

Accepted Answer

Have the designated business risk owner formally document and sign off on acceptance of the residual risk

Answer

Delay the product launch until the vulnerability is fully remediated regardless of cost

Answer

Have the security manager quietly log the risk in the register and proceed with the launch

Answer

Purchase cyber insurance to transfer the entire residual risk before launching