Cisco Certified Support Technician (CCST) CybersecurityRisk ManagementHard
An organization relies heavily on a specific proprietary software application for its core business operations. A recent security audit revealed a critical zero-day vulnerability in this application. The software vendor has acknowledged the vulnerability but has not yet released a patch, and no immediate workaround is available. The organization determines that decommissioning the application is not feasible due to business continuity requirements. What is the most appropriate immediate risk response strategy the organization is forced to take in this specific situation?
- ARisk Avoidance
- BRisk Reduction
- CRisk Acceptance
- DRisk Transfer
Show answer & explanationAnswer & explanation
Correct answer: C. Risk Acceptance
Given that decommissioning (avoidance) is not feasible, no patch or workaround (preventing reduction) is available, and transfer isn't an immediate option, the organization has no choice but to continue operating with the known critical vulnerability. This is a forced, active risk acceptance due to lack of other viable immediate options, often with plans for future mitigation.
Why the other options are wrong
- A. Risk avoidance (decommissioning) is explicitly stated as not feasible.
- B. Risk reduction is not immediately possible as there is no patch or workaround.
- D. Risk transfer (e.g., insurance) might be a long-term part of the strategy, but it doesn't address the immediate operational risk of the vulnerability.
Forced Risk Acceptance
A situation where an organization has no viable option but to accept a known risk, often due to lack of immediate mitigation solutions, business continuity requirements, or prohibitive costs of other strategies.
- Often temporary, while long-term solutions are sought.
- Requires clear documentation and management approval.
- May involve heightened monitoring or contingency planning.
Memory trick: No options, no time, no money: forced to accept.