[Governance, Risk, and Compliance (GRC)] Company A acquired Company B. During an audit, a security engineer found Company B's environment was inadequately patched. In response, Company A placed a firewall between the two environments until Company B's infrastructure could be integrated into Company A's security program. Which of the following risk-handling techniques was used?

The action of placing a firewall between the two company environments is a form of risk mitigation. Mitigation involves implementing controls to reduce the likelihood or impact of an identified risk. In this scenario, the firewall acts as a compensating control to segment the networks and limit the exposure from Company B's unpatched systems, thereby reducing the risk of a security breach spreading to Company A's infrastructure while a permanent solution (patching) is implemented.

A. Accept: This is incorrect because the company took a specific, active measure (installing a firewall) to address the risk, rather than simply acknowledging and accepting it without action.
B. Avoid: This is incorrect because the company is proceeding with the integration of Company B. Risk avoidance would have involved ceasing the activity causing the risk, such as canceling the acquisition.
C. Transfer: This is incorrect because the company is managing the risk internally. Risk transfer involves shifting the financial impact to a third party, for example, through cyber insurance or outsourcing.

1. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39

Managing Information Security Risk (March 2011). In Section 2.3

"Risk Response

" the document defines risk mitigation as: "Modifying or reducing the risk by implementing controls." The firewall is a control implemented to reduce the risk. (Page 16).

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations (December 2018). In Section 2.4

"Risk Response

" it states that a common risk response option is "risk mitigation (also known as risk reduction)

which involves taking action to reduce the likelihood of a threat event’s occurrence and/or the adverse impact of the event." (Page 16).

3. Carnegie Mellon University

Software Engineering Institute

OCTAVE Allegro: Information Security Risk Assessment (May 2007). In Step 7

"Develop a Risk Response Strategy

" the document describes mitigation as the approach where "the organization decides to act to reduce the impact or likelihood (or both) of a risk." (Page 31).