For a low-impact municipal brochure website, leadership considers cyber insurance and formally accepting residual risk after basic hardening. Which statement best describes this approach?
Select an answer to reveal the explanation.
Short Explanation
Not every risk needs a vault and a SWAT team. For a low-impact brochure site, harden the obvious stuff, maybe buy insurance, and consciously accept what's left if it's inside appetite. Treatment is a toolbox—avoid, mitigate, transfer, accept—not a single hammer.
Full Explanation
Risk treatment options include avoidance, mitigation, transfer, and acceptance. Cyber insurance is a common transfer mechanism that does not remove the need for basic controls or acknowledgment of residual risk. Matching treatment intensity to impact and appetite is core risk management practice.