Question

According to the Security Risk Management: Building an Information Security Risk Management Program From the Ground Up textbook, "there will be risks that can't be mitigated at all, aren't worth the effort to reduce the exposure any further, or just won't be addressed in the short term due to other priorities" (p. 47). Provide a real-world example for each of these three scenarios and explain why the risk meets the criteria.

Answer 1

Answer with Explanation:

Risk which can’t be mitigated: The risks that the share price would fall due to sudden political environment instability or events that effects the economy will definitely affect the business operations as well. Thus are the risks that can not be mitigated at all. Another example would be Corona virus implications on the operation of the company which is again a risk that can't be mitigated.

Risks, that aren’t worth the effort to reduce the exposure any further:

The part of the sentence talks about the risk exposure which says that if the company doesn't resides in an area which is not prone to seismic activity and the chances of earthquake in a country is below 0.000001% which is almost negligible but still it is worthless to purchase the earthquake insurance. As this risk is almost negligible hence it is not worth the effort to reduce the exposure any further.

Risks that wouldn't be addressed in short term due to other priorities:

The risks that will not occur in the next 12 month, can be addressed after 6 months and thus allowing the company to prioritize the risks that must be resolved first. This means that if their is a risk that one of our several products that would be launched after 12 months from now will not be winning customer market can be addressed after 6 months because it is dependent on our future action. If we don't launch our product, our product is not rejected by the customer. Hence situations like this allows us to prioritize our risks.