A library kiosk still runs a legacy catalog plugin that cannot support MFA. The risk is rated low, the catalog is air-gapped from payment systems, and leadership documents a time-boxed exemption. Which strategy is being used?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the leftover pebble isn't worth a jackhammer—so leadership signs a note saying they'll live with it for now, under rules and a sunset date. That's documented acceptance with an exception, not pretend mitigation.
Full Explanation
Risk acceptance retains a risk within appetite when further treatment is impractical or not cost-justified, typically with an approved exception or exemption and review date. Transfer moves consequences elsewhere; avoidance stops the activity; falsifying control status is not a legitimate strategy.