Práctica ISC2 CISSP

A CISO must decide whether to accept, mitigate, transfer, or avoid the risk of a legacy payment system that cannot be patched for a known vulnerability but generates significant revenue. The company purchases cyber insurance specifically covering breaches originating from this system. Which risk response is this?

• ARisk acceptance
• BRisk mitigation
• CRisk transfer
• DRisk avoidance