Which choice below most accurately reflects the goals of risk
mitigation?

A.
Analyzing the effects of a business disruption and preparing the
company’s response

B.
Analyzing and removing all vulnerabilities and threats to security
within the organization

C.
Defining the acceptable level of risk the organization can tolerate,
and reducing risk to that level

D.
Defining the acceptable level of risk the organization can tolerate,
and assigning any costs associated with loss or disruption to a third
party, such as an insurance carrier

Explanation:
The correct answer is “Defining the acceptable level of risk the organization can tolerate,
and reducing risk to that level “. The goal of risk mitigation is to reduce
risk to a level acceptable to the organization. Therefore risk needs to
be defined for the organization through risk analysis, business
impact assessment, and/or vulnerability assessment.
Answer “Analyzing and removing all vulnerabilities and threats to security
within the organization” is not possible. Answer “Defining the acceptable level of risk the
organization can tolerate, and assigning any costs associated with loss or disruption to a third
party, such as an insurance carrier” is called risk transference.
Answer “Analyzing the effects of a business disruption and preparing the
company’s response ” is a distracter.