A company has completed the implementation of technical and management controls as required by its adopted security policies and standards. The implementation took two years and consumed all the budget approved to security projects. The board has denied any further requests for additional budget. Which of the following should the company do to address the residual risk?
A) Transfer the risk
B) Baseline the risk
C) Accept the risk
D) Remove the risk

Question

Quizplus · Accepted Answer

Since the company has exhausted its budget and implemented all required controls, it may need to accept the residual risk as it cannot allocate additional resources to further mitigate it.

A Company Has Completed the Implementation of Technical and Management