After phishing controls and a cyber policy are in place, leaders accept a small documented residual cyber exposure and attach an incident playbook with an owner. Which path does this follow?
Select an answer to reveal the explanation.
Short Explanation
Do the sensible hardening, buy the sensible cover, then own the leftover nibble with a playbook and a name on it. That's the full treat-then-accept path — not "accept" as code for doing nothing.
Full Explanation
Reduce and transfer where appropriate, then accept the documented residual with a response plan is the path after phishing controls and a cyber policy are in place and leaders accept a small documented residual with an owner and incident playbook. That sequence—controls, insurance, conscious residual acceptance, response readiness—is sound layered treatment for civic cyber risk.
Accepting first with no controls then forbidding any insurance or training afterward inverts order and leaves intolerable uncontrolled exposure. Avoiding all digital services so residual cyber risk never needs documentation may be theoretical avoidance but abandons modern civic operations and is not the path described. Transfer alone by purchasing insurance and deleting the incident playbook strips response capability and skips reduction and structured residual acceptance.
Exam caveat: CRMC favors layered treatment ending in documented residual acceptance with ownership and response plans—not insurance-only or accept-first-without-controls patterns.
Operational check: Confirm the city’s cyber register shows implemented reductions, active policy (transfer), residual rating within appetite, named owner, review date, and linked incident playbook tested in a tabletop.