A vulnerable public kiosk system cannot be hardened cost-effectively, and the city decides to stop offering that kiosk service. Which risk treatment is that?
Select an answer to reveal the explanation.
Short Explanation
Best fix sometimes is shutting the ride down. Retire the kiosk service and you avoid the risk — not accept it, not insure it, not wiki it.
Full Explanation
When a vulnerable public kiosk system cannot be hardened cost-effectively and the city decides to stop offering that service, the correct treatment is avoid by retiring the kiosks and eliminating the activity. Avoidance removes the civic exposure by ending the risky operation. Accept fails by concept because acceptance leaves the kiosks running unchanged, which contradicts the decision to stop. Transfer fails by concept because retiring a system is not buying insurance or shifting contractual risk. Mitigate by leaving kiosks online and only updating a wiki fails by concept because documentation without control improvement or retirement does not reduce the vulnerability. Exam caveat: CIS-RC defines avoid as eliminating the activity or asset that creates the risk. Operational check: record avoid on the kiosk risk, execute decommission of the public kiosks, verify the service is offline, and retire or close the risk with decommission evidence attached. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.