Risk Acceptance means acknowledging a risk and choosing not to take further action because the cost of mitigation may outweigh the benefits.
It is the last resort when:
The risk is low impact or unlikely to occur.
Other options (mitigation, transfer, avoidance) are not feasible.
Why Not Other Options?
A (Transfer) → Moving risk to a third party (e.g., insurance).
C (Mitigation) → Implementing security controls to reduce risk.
D (Avoidance) → Eliminating the risk entirely (e.g., discontinuing a service).
[Reference: CompTIA CySA+ CS0-003, Chapter 9: "Risk Management and Compliance," Section: "Risk Response Strategies.", ]
Submit