Study. uk . com
  1. Home
  2. All questions
  3. Question 83

CISSP study material · question 83 of 500

An insurer will cover part of a firm's losses from a data breach in exchange for a premium. Under the risk response vocabulary of NIST SP 800-39, how should this arrangement be classified?

  1. Avoiding the risk.
  2. Transferring the risk.
  3. Accepting the risk.
  4. Mitigating the risk.
Show the answer

Answer: B. Transferring the risk.

SP 800-39 recognises accept, avoid, mitigate, share and transfer. Paying a third party to carry the loss is transfer; mitigation reduces it and avoidance abandons the activity entirely.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.1 Components of Risk Management

Challenge yourself on this topic → Study as cards