Which of the following is the MOST important criterion when deciding whether to accept residual risk?
Which of the following is the MOST important criterion when deciding whether to accept residual risk?
When deciding whether to accept residual risk, the most important criterion is the cost of additional mitigation. This criterion helps ensure that the decision is cost-effective and that the benefits of reducing the risk outweigh the expenditures. Even if an asset has a high annual loss expectancy (ALE), the cost-benefit analysis of additional mitigation measures is crucial to determine if accepting the residual risk is practical.
According to the Certified Information Security Manager (CISM) Review Manual: "Decisions to accept residual risk should be based on considerations such as the cost-effectiveness of additional mitigation, the criticality of the asset to the enterprise’s mission, the asset’s value and the impact of the asset’s loss." (CISM Review Manual 15th Edition, p. 124)
The MOST important criterion when deciding whether to accept residual risk is the cost of additional mitigation. Therefore, the correct answer is option C.
I think B is correct, in order to compare the cost you should know the ALE,
even if the risk is equal or greater than the asset value, the annual rate of occurrence matters. so I think B
If additional mitigation is too costly and not cost effective enough, you can only accept the risk
Cost of Mitigating the Asset so answer would be C
Most important is the ALE. You cannot decide to accept the risk if you have not defined the ALE and matched it up to the cost of mitigation.
i vote .....A. Cost of replacing the asset
ANSWER C : The security manager would be most concerned with whether residual risk would be reduced by a greater amount than the cost of adding additional controls. The other choices, although relevant, would not be as important.
I'm torn between B and, but leaning more towards C. If additional mitigation is not cost effective and the risk is still deemed too high, then the only other choice would be risk avoidance. But if that isn't possible, the only thing a business can do is accept the residual risk. ALE is important for determining a a potential loss an asset would suffer due to a threat realization over a year. But you can reduce ALE up to a point after which it stops being cost effective.
Cost of additional mitigation. What if you have a high ALE but the cost of mitigation is even higher. I believe is always how much it cost.
B. Annual loss expectancy (ALE)