ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Mitigation seeks to reduce either the likelihood or impact of a threat by adding or improving safeguards. Encrypting all backups introduces a technical control that directly reduces the probability and consequence of unauthorized disclosure; documenting the task, responsible party, and due date in the POA&M demonstrates a concrete plan for remediation. Purchasing cyber-insurance transfers financial consequences rather than reducing the vulnerability. Formally noting the issue for the authorizing official without changing controls is risk acceptance. Suspending all backups removes the specific exposure but also eliminates the ability to recover data; it therefore shifts rather than accepts or transfers risk and is considered an extreme form of mitigation, not the preferred treatment here.