A public-health agency asks who owns residual risk after the penetration test findings are delivered. Who owns that decision?
Select an answer to reveal the explanation.
Short Explanation
The tester hands over a clear weather report; the agency still owns the ship. Findings inform decisions — they do not move risk ownership onto the assessor. Acceptance and fixes stay with the client.
Full Explanation
Penetration testers provide evidence, impact analysis, and remediation guidance. Acceptance of residual risk, prioritization, and mitigation funding remain with the client organization that owns the systems and mission. Assigning residual risk to the tester, a tool vendor, or an insurer misstates governance. Clear ownership avoids stalled remediation after delivery.