[Emerging Technologies and Threats] An engineering team determines the cost to mitigate certain risks is higher than the asset values The team must…

When the expenditure to mitigate a threat exceeds the asset’s value, the preferred risk-response strategy is transference rather than direct mitigation. Purchasing cyber-insurance shifts (transfers) the potential financial loss to a third-party for a predictable premium, allowing the organization to keep its limited resources focused on higher-value risks while still documenting that the lower-value risks have been addressed in a cost-effective manner. This satisfies prioritization requirements without incurring mitigation costs greater than the protected asset’s worth.

A. Data labeling only classifies information; it neither offsets nor transfers financial exposure when mitigation is cost-prohibitive.

B. Branch protection secures source-code repositories but does not address the overarching cost-benefit mismatch for unrelated risks.

C. Vulnerability assessments identify weaknesses; they do not resolve the problem of mitigation costs exceeding asset value.

1. NIST Special Publication 800-30 Rev. 1

Guide for Conducting Risk Assessments

§3.3 “Risk Response – Transfer

” pp. 18-19.

2. NIST SP 800-37 Rev. 2

Risk Management Framework

§3.1 “Respond

” p. 19.

3. ISO/IEC 27005:2018

Information Security Risk Management

Clause 8.3.2 “Risk Treatment—Transfer.”

4. Carnegie Mellon University (Heinz College) course “Risk Management for Information Systems

” Lecture 6 slides 12-14 (insurance as cost-effective risk treatment).