An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which option is MOST appropriate for a low-likelihood, low-impact risk where mitigation cost exceeds potential loss?
-
A
Mitigate by implementing compensating controls
-
B
Transfer via cyber liability insurance
-
C
Accept the risk and document the decision
-
D
Avoid the risk by discontinuing the activity