A board minutes note says ransomware risk is "accepted," but there is no rationale, risk owner, residual description, or review date. What is missing for valid acceptance?
Select an answer to reveal the explanation.
Short Explanation
Real acceptance looks like a signed decision with a name on it — not a sticky note that says "we'll live with it" and then everyone forgets. No owner, no rationale, no review? That's neglect wearing an acceptance costume.
Full Explanation
Conscious, documented acceptance with ownership—not unlabeled neglect—is missing when board minutes say ransomware risk is “accepted” without rationale, risk owner, residual description, or review date. Valid acceptance is an explicit decision about residual exposure within appetite, assigned to someone who monitors it. Civic boards that stamp “accepted” without those elements are practicing neglect, not treatment.
Requiring refusal of all cyber insurance before acceptance is allowed fails by concept because acceptance can coexist with partial transfer; insurance status is not a purity test that forbids documented residual acceptance. Automatic acceptance of every IT risk once the board meets quarterly fails because calendar meetings do not create risk-by-risk rationale, owners, or residuals. Deleting incident response plans to prove the risk was truly accepted fails because acceptance of residual cyber exposure still requires response capability; destroying playbooks increases severity.
Exam caveat: MSI CRMC acceptance demands documentation—rationale, residual description, owner, and review cadence. A bare minute entry is insufficient.
Operational check: Amend the ransomware register entry with residual rating, why it sits within appetite, named owner, review date, and link to the incident playbook; present the completed acceptance package at the next board risk discussion.