A library kiosk still runs a legacy catalog plugin that cannot support MFA. The risk is rated low, the catalog is air-gapped from payment systems, and leadership documents a time-boxed exemption. Which strategy is being used?

Risk acceptance retains a risk within appetite when further treatment is impractical or not cost-justified, typically with an approved exception or exemption, compensating controls where possible, and a review or sunset date. A library kiosk legacy catalog plugin that cannot support MFA, rated low risk, air-gapped from payment systems, and covered by a time-boxed documented exemption is acceptance—not pretend mitigation or unrelated insurance. Leadership knowingly keeps the risk under defined conditions. Transfer via purchasing cyber insurance for unrelated cloud email only does not address the kiosk catalog risk. Transfer must map to the actual residual exposure; buying coverage for a different system is not acceptance of the plugin risk and does not treat it. Avoidance by immediately shutting every branch without notice would eliminate library services rather than accept a low, contained risk. Avoidance is disproportionate here and conflicts with the documented exemption approach described in the stem. Mitigation by claiming MFA is already enforced when it is not is false assurance. Fraudulent status reporting is neither mitigation nor acceptance; it undermines the control environment and audit integrity. Exam caveat: Documented, authorized, time-bounded exceptions for low residual risk illustrate acceptance. Watch for distractors that rename avoidance, irrelevant transfer, or dishonest control claims as if they were acceptance. Operational check: File the exemption with owner, residual risk rating, compensating controls such as air-gapping, and expiration date; reassess before renewal so the legacy plugin does not become permanent untracked debt.