A public-health agency asks who owns residual risk after the penetration test findings are delivered. Who owns that decision?
Select an answer to reveal the explanation.
Short Explanation
The tester hands over a clear weather report; the agency still owns the ship. Findings inform decisions — they do not move risk ownership onto the assessor. Acceptance and fixes stay with the client.
Full Explanation
After findings are delivered to a public-health agency, residual risk acceptance and mitigation decisions belong to the client organization. The tester informs with evidence and recommendations but does not personally own residual risk for unpatched issues after report delivery. Scanner vendors named in a tools appendix do not inherit system ownership. Cyber insurers are stakeholders, not automatic system owners until every finding closes. Exam caveat: contracts may require retest windows, yet acceptance of remaining risk still sits with the agency's leadership and risk office. Operational check: present each critical finding with impact, likelihood context, and remediation options; obtain written acknowledgment of ownership and next steps from the designated agency risk owner; track open items in the client's risk register rather than the tester's personal backlog. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.