ISC2 CISSP Practice Question

Risk acceptance is appropriate when management consciously acknowledges a threat but elects not to reduce its likelihood or impact because the cost of other responses-such as mitigation, transference, or avoidance-would exceed the potential loss. In this scenario, implementing controls would cost far more than the $15 000 estimated impact, so leaving the system as-is represents acceptance. Risk avoidance would eliminate the activity altogether, risk transfer would shift liability to a third party (for example, by purchasing insurance), and risk mitigation would add controls to lower probability or impact.