For a low-impact municipal brochure website, leadership considers cyber insurance and formally accepting residual risk after basic hardening. Which statement best describes this approach?
Select an answer to reveal the explanation.
Short Explanation
Not every risk needs a vault and a SWAT team. For a low-impact brochure site, harden the obvious stuff, maybe buy insurance, and consciously accept what's left if it's inside appetite. Treatment is a toolbox—avoid, mitigate, transfer, accept—not a single hammer.
Full Explanation
For a low-impact municipal brochure website, combining basic hardening with cyber insurance and formal acceptance of remaining residual risk can be an appropriate blend of mitigation, transfer, and acceptance when residual risk sits within organizational appetite. Not every public-facing site warrants avoidance or maximum controls; treatment selection should match impact and value. Claiming insurance is never valid, or that only avoidance is allowed for public websites, rejects legitimate transfer options recognized in risk frameworks. Forcing the brochure site onto a SCADA VLAN before acceptance is allowed confuses network trust domains and can increase OT risk rather than manage web residual risk. Transfer through insurance does not eliminate residual risk; policies have limits, exclusions, and retention, so acceptance language remains relevant for what insurance will not cover. Exam caveat: CISSP risk treatment includes mitigate, transfer, avoid, and accept—often in combination—based on appetite after reasonable controls. Operational check: document basic hardening completed, residual risk statement, insurance coverage scope, and approving authority; ensure the brochure site is not mis-tiered as critical infrastructure; and revisit if the site later collects sensitive data or payments that change impact. Keep acceptance time-bounded with periodic review so 'accepted' does not become forgotten.