A review of the risk register shows dozens of risk acceptances recorded several years ago with no expiry or review dates. Some of the underlying systems have changed significantly since then. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
An acceptance is a permission slip for today's conditions, not a lifetime pass. Put an expiry date on it so you force the owner to look again. The trap is either tearing them all up or treating an old signature as forever valid.
Full Explanation
A risk acceptance reflects a decision made under particular conditions: the threat landscape, the system's configuration, the controls in place and the business value at that time. When those conditions change, the decision may no longer be valid. Acceptances should therefore be documented with a defined expiry or review date, linked to the owner, and periodically reassessed so that owners either renew them with current information, treat the risk or retire it. Introducing review dates and running a reassessment of the existing backlog restores that discipline. Closing every acceptance older than a year and mandating remediation is an arbitrary rule that overrides owners' decisions and may force costly fixes for risks that remain acceptable. Leaving the acceptances untouched ignores the evidence that the systems have changed, so the original decisions may now rest on false assumptions. Moving the acceptances to the security team removes ownership from the business, which is contrary to the principle that risk owners, not security, accept risk. Exam caveat: significant change should also trigger an early review regardless of the scheduled date. Operational check: confirm each acceptance in the register has an owner, a review date and evidence of its most recent reassessment.