Chapter 3: IT Risk Response and Mitigation Flashcards
The risk response decision is based on
the information provided in the earlier steps of risk identification and assessment
The risk response must ensure that
business operations are protected but not unduly impaired or impacted by controls that are put in place to address risk
What are the four commonly accepted risk response options?
risk acceptance
risk mitigation
risk avoidance
risk transfer
In risk acceptance, who is responsible for the risk in case it occurs?
Management
What is risk acceptance?
It is the amount of risk that senior management has determined is within acceptable or permissible bounds
What is risk ignorance?
It is the failure to identify or acknowledge risk or it is a decision to blindly accept risk without knowing what the risk level really is
When is risk tolerance used?
in an exceptional circumstance where the level of risk may exceed the risk acceptance boundary set by senior management but the decision is made to accept the risk anyway
What is self insurance?
Deciding to absorb the potential costs of an incident
What is risk mitigation?
Acton is taken to reduce the frequency and/or impact of risk
What is risk avoidance?
Exiting the activities or conditions that give rise to the risk
When does risk avoidance apply?
there is no other cost-effective response that can succeed in reducing the frequency and impact below the defined thresholds for risk appetite
the risk cannot be shared or transferred
the exposure level is deemed unacceptable by management
What is risk transfer?
the decision to reduce loss through sharing the risk of loss with another organization
What factors should be considered in selecting a risk response?
priority of the risk
recommended control from the risk assessment report
other response alternatives
cost of the various response options
requirements for compliance with regulations or legislation
alignment of the response option with the strategy of the organization
possibility of integrating the response with other organizational initiatives
compatibility with other controls in place
time, resources, and budget available
This analysis is used to justify the expense associated with the implementation of controls
cost benefit analysis
What are the factors that must be included in the calculating the total cost of the control:
Cost of acquisition
Cost of maintenance
Cost to remove / replace the control
