Question

A company has completed the implementation of technical and management controls as required by its adopted security policies and standards. The implementation took two years and consumed all the budget approved to security projects. The board has denied any further requests for additional budget.

Which of the following should the company do to address the residual risk?

A. Transfer the risk
B. Baseline the risk
C. Accept the risk
D. Remove the risk

Answer 1

Without further budget, the most feasible option for a company that has implemented all required controls is to accept the residual risk. This means acknowledging and being prepared to deal with the consequences of any related security incident.

Step-by-step explanation:

When a company has implemented all the necessary technical and management controls as stipulated by its security policies and standards, and no further budget is available, it must decide on how to deal with any residual risk. The options available are to transfer, baseline, accept, or remove the risk.

Given that no more budget is available and the board has denied additional funds, the most feasible option is usually to accept the risk.

This means that the company acknowledges the presence of the residual risk and decides to take no further action, accepting the potential consequences as a result of any security incidents that might arise from these unmitigated risks.

To address the residual risk after completing the implementation of controls, the company should accept the risk. Accepting the risk means acknowledging that there is still a level of risk present and deciding not to take any further action to mitigate or transfer it. In this case, the board has denied additional budget, so accepting the risk is the only viable option.