ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Deploying additional controls (input validation and sandboxing) to reduce the probability or impact of a vulnerability is a form of risk mitigation. Mitigation lowers the risk to an acceptable level while the component continues to be used. Accepting the risk would involve knowingly taking no action. Avoidance would require removing or replacing the vulnerable library altogether, and transferring the risk would shift responsibility elsewhere through mechanisms such as insurance or contractual clauses. Because the team actively reduces, rather than ignores, eliminates, or transfers the risk, their choice is mitigation.