A legacy internal reporting tool has low residual risk after compensating controls, and leadership will not fund further hardening. What documented treatment fits?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the answer is 'we will live with this,' but only if someone signed for it. Formal accept with an accountable owner — not eternal draft purgatory.
Full Explanation
Accept is a documented treatment when residual risk is within appetite and an accountable owner signs off. Leaving risks in draft, labeling avoid while the system runs, or informal broker emails without IRM documentation do not complete acceptance.