A library system formally accepts residual risk on a legacy catalog server. What validation prevents that acceptance from lasting forever without revisit?
Select an answer to reveal the explanation.
Short Explanation
Acceptance is a timed parking permit, not a forever deed. Put a review date on accepted risks so someone looks again before the world changes. Hiding them from dashboards or zeroing residual is how silent risk piles up.
Full Explanation
When a library system formally accepts residual risk on a legacy catalog server, require a review or next-assessment date on accepted risks so acceptance is time-bound and rechecked. Time-bound acceptance prevents forever shrugs on civic catalog infrastructure. Removing the risk from all dashboards so accepted items never resurface fails by concept because hiding accepted risks removes oversight. Setting residual to zero automatically when Accept is chosen fails by concept because acceptance acknowledges residual; it does not magically eliminate it. Converting acceptance into permanent policy retirement with no follow-up fails by concept because policy retirement is a different construct and still needs revisit discipline. Exam caveat: CIS-RC expects accepted risks to carry review or next-assessment dates. Operational check: on the accepted catalog-server risk, set a next review date, schedule the reassessment task, and verify the risk still appears on accepted-risk review lists as the date approaches. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.