[Risk Assessment and Incident Recovery] Which of the following risk mitigation strategies involves execution of controls to reduce the risk factor and brings it to an acceptable level or accepts the potential risk and continues operating the IT system?

Risk assumption, also known as risk acceptance, is a strategy where an organization makes a conscious decision to accept the potential loss from a risk and continue operating. This decision is made under two primary conditions described in the question:
1. After implementing controls (risk mitigation) that reduce the risk to a level deemed acceptable by the organization (accepting the residual risk).
2. When the cost of mitigation outweighs the potential loss, leading to the acceptance of the risk in its current state. Both scenarios involve a deliberate choice to assume the risk and proceed with the IT system's operation.

B. Risk avoidance: This strategy involves eliminating the risk by ceasing the activity that causes it, which is the opposite of continuing to operate the system.
C. Risk planning: This is the overarching process of identifying, analyzing, and determining how to handle risks; it is not a specific response strategy itself.
D. Risk transference: This strategy involves shifting the financial impact of a risk to a third party, such as through insurance or outsourcing, not accepting it internally.

1. NIST Special Publication 800-30

Revision 1

Guide for Conducting Risk Assessments.

Section 3.3

Page 49: This section outlines risk response options. It defines Risk Acceptance as the appropriate response when the identified risk is within the organizational risk tolerance. It states

"Organizations can accept risk deemed to be residual risk... or risk that cannot be avoided

shared

or mitigated." This directly supports the concept of accepting risk after controls bring it to an "acceptable level."

2. NIST Special Publication 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations.

Section 2.5

Page 20

"Step 5: Authorize": This step involves the authorizing official making an explicit risk acceptance decision. It states

"The risk determination... provides the authorizing official with the necessary information to make a credible

risk-based decision to either authorize the system... or not to authorize the system." This authorization is a formal act of risk assumption.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

Continuous Risk Management Guidebook.

Chapter 6

"Mitigation

" Page 69: The guidebook describes risk handling strategies. It notes that after mitigation planning

a decision is made. "Accepting the risk means that the project team has decided to live with the risk... This is a valid response if the risk impact is low or the probability of occurrence is small." This aligns with the second part of the question's description.