iSACA Cybersecurity Fundamentals Certification Practice Exam

Which response option allows an organization to absorb a loss?

1. Avoid

2. Mitigate

3. Accept

4. Share/Transfer

The correct answer is: Accept

The response option that allows an organization to absorb a loss is the one that involves accepting the risk rather than trying to eliminate or lessen it. When an organization chooses to accept a risk, it acknowledges the potential negative impact and decides to bear the consequences if the risk materializes. This approach is often taken when the cost of mitigating a risk is higher than the potential loss that could result from it, or when the likelihood of the risk occurring is considered low. Accepting risk does not involve any specific actions to reduce the likelihood or impact of a loss, but instead involves a conscious decision to live with that risk as part of the organization's broader risk management strategy. This method is particularly relevant in scenarios where the organization has determined that it can withstand the loss without severe repercussions, allowing it to allocate resources to more critical areas. In contrast, the other options involve proactive measures to manage risks. Avoiding a risk means taking steps to eliminate it completely, mitigating a risk involves reducing its impact or likelihood, and sharing or transferring risk typically includes strategies like insurance or outsourcing to distribute risk across other entities. These strategies seek to minimize the organization’s exposure to loss rather than absorbing it.