Which of the following is the MOST effective way to treat a risk such as a natural disaster that has a low
probability and a high impact level?

A.
Implement countermeasures.

B.
Eliminate the risk.

C.
Transfer the risk.

D.
Accept the risk.

Explanation:

Risks are typically transferred to insurance companies when the probability of an incident is low but the impact is high. Examples include: hurricanes, tornados and earthquakes. Implementing countermeasures may not be the most cost-effective approach to security management. Eliminating the risk may not be possible. Accepting the risk would leave the organization vulnerable to a catastrophic disaster which may cripple or ruin the organization. It would be more cost effective to pay recurring insurance costs than to be affected by a disaster from which the organization cannot financially recover.