Suppose your company has just passed a security risk assessment exercise. The results display that the risk of the breach in the main company…

The organization has already performed risk mitigation by implementing controls, which successfully reduced the risk from 50% to 10%. This remaining 10% is the residual risk. The company's risk threshold, or risk appetite, is 20%. Since the residual risk (10%) is below the acceptable threshold (20%), the most appropriate and cost-effective business decision is to formally accept the remaining risk. This action aligns with the goal of maximizing profit by avoiding unnecessary expenditure on further controls that would provide diminishing returns, allowing the project to proceed successfully.

B. Introduce more controls to bring risk to 0%: Achieving zero risk is typically impossible and the cost of attempting to do so would be prohibitive, directly contradicting the goal of maximizing business profit.

C. Mitigate the risk: Risk mitigation has already been successfully performed. The current decision is about how to treat the residual risk, which is now at an acceptable level.

D. Avoid the risk: Risk avoidance, such as discontinuing the application, is a drastic measure for risks that cannot be reduced to an acceptable level. It is inappropriate here.

---

1. NIST Special Publication 800-30

Revision 1

"Guide for Conducting Risk Assessments."

Section 2.3.4

"Risk Response

" Page 21: This section outlines risk acceptance as a valid response. It states

"An organization can accept a risk when the identified risk is within the organization’s risk tolerance." The scenario clearly shows the residual risk (10%) is within the defined tolerance (20%).

2. NIST Special Publication 800-39

"Managing Information Security Risk: An Organization-Wide Approach for Information Security."

Section 2.3

"RISK RESPONSE

" Page 13: This document defines the four risk response options. For risk acceptance

it specifies that this is a valid strategy when "the organization has determined that the risk is within its risk tolerance."

3. Peltier

T. R. (2010). Information Security Risk Analysis (3rd ed.). Auerbach Publications.

Chapter 6

"Risk Mitigation

" Section on "Acceptance

" Page 119: This academic and professional text explains that risk acceptance is a viable strategy when the cost of controls is greater than the potential loss

or when the residual risk is within the organization's defined risk appetite.

4. Carnegie Mellon University

Software Engineering Institute. (2010). OCTAVE Allegro: Information Security Risk Assessment. (CMU/SEI-2007-TR-012).

Step 7

"Select and Prioritize Areas for Improvement

" Page 31: This methodology

developed at a leading university

guides organizations to develop mitigation plans for unacceptable risks. By implication

risks that are evaluated and found to be within an acceptable threshold do not require further mitigation and are thus accepted.