The only use of the acceptance strategy that industry practices recognize as valid occurs when the organization has done all but which of the following?
A) Determined the level of risk posed to the information asset
B) Performed a thorough cost-benefit analysis
C) Determined that the particular function, service, information, or asset did justify the cost of additional protection
D) Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability

Question

Quizplus · Accepted Answer

Acceptance strategy is valid when the cost of additional protection is not justified, not when it is justified.

The Only Use of the Acceptance Strategy That Industry Practices