Residual risk for missing MFA on a citizen-facing portal remains above appetite. Which response and linkage is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Above appetite and fixable? Mitigate — and glue real MFA remediation tasks to the risk so the decision is not just a hopeful label.
Full Explanation
When residual risk for missing MFA on a citizen-facing portal remains above appetite, the appropriate response is mitigate with remediation tasks that close the MFA gaps. Mitigation drives concrete work to bring civic portal exposure within tolerance. Choosing accept with no tasks and leaving MFA gaps unowned fails by concept because acceptance above appetite without ownership is neglect, not governed acceptance. Choosing avoid by deleting the risk record while the portal stays live fails by concept because deleting a record does not eliminate the activity or exposure. Choosing transfer by renaming the risk category without financial or contractual transfer fails by concept because cosmetic renaming is not risk transfer. Exam caveat: CIS-RC maps residual-above-appetite situations to mitigate with linked remediation when treatment is to reduce exposure. Operational check: set treatment to mitigate on the portal MFA risk, link remediation tasks for MFA rollout, and track residual until it falls within documented appetite. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.