A legacy internal reporting tool has low residual risk after compensating controls, and leadership will not fund further hardening. What documented treatment fits?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the answer is 'we will live with this,' but only if someone signed for it. Formal accept with an accountable owner — not eternal draft purgatory.
Full Explanation
When a legacy internal reporting tool has low residual risk after compensating controls and leadership wants to live with it, formally accept the low residual risk with accountable owner sign-off recorded on the risk. Governed acceptance is explicit, owned, and reviewable for civic IT portfolios. Leaving the risk in draft forever so no one acknowledges the decision fails by concept because draft limbo avoids accountability. Marking the risk as avoided even though the tool remains in production fails by concept because avoid requires eliminating the activity, not relabeling. Transferring by emailing a screenshot to the insurance broker with no record update fails by concept because informal email is not a recorded transfer treatment. Exam caveat: CIS-RC treats acceptance as a formal, signed decision on the risk—not draft avoidance or mislabeled avoid/transfer. Operational check: record accept on the low-residual reporting-tool risk with owner sign-off and next review date, and verify the treatment and approver appear on the risk form. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.