[Emerging Technologies and Threats] An engineering team determines the cost to mitigate certain risks is higher than the asset values The team must ensure the risks are prioritized appropriately. Which of the following is the best way to address the issue?

When the expenditure to mitigate a threat exceeds the asset’s value, the preferred risk-response strategy is transference rather than direct mitigation. Purchasing cyber-insurance shifts (transfers) the potential financial loss to a third-party for a predictable premium, allowing the organization to keep its limited resources focused on higher-value risks while still documenting that the lower-value risks have been addressed in a cost-effective manner. This satisfies prioritization requirements without incurring mitigation costs greater than the protected asset’s worth.

A. Data labeling only classifies information; it neither offsets nor transfers financial exposure when mitigation is cost-prohibitive.
B. Branch protection secures source-code repositories but does not address the overarching cost-benefit mismatch for unrelated risks.
C. Vulnerability assessments identify weaknesses; they do not resolve the problem of mitigation costs exceeding asset value.

1. NIST Special Publication 800-30 Rev. 1, Guide for Conducting Risk Assessments, §3.3 “Risk Response – Transfer,” pp. 18-19.

2. NIST SP 800-37 Rev. 2, Risk Management Framework, §3.1 “Respond,” p. 19.

3. ISO/IEC 27005:2018, Information Security Risk Management, Clause 8.3.2 “Risk Treatment—Transfer.”

4. Carnegie Mellon University (Heinz College) course “Risk Management for Information Systems,” Lecture 6 slides 12-14 (insurance as cost-effective risk treatment).