Which choice below most accurately reflects the goals of risk mitigation?

A.
Analyzing the effects of a business disruption and preparing the company’s response

B.
Analyzing and removing all vulnerabilities and threats to security within the organization

C.
Defining the acceptable level of risk the organization can tolerate, and reducing risk to that level

D.
Defining the acceptable level of risk the organization can tolerate, and assigning any costs
associated with loss or disruption to a third party, such as an insurance carrier

Explanation:
The correct answer is “Defining the acceptable level of risk the organization can tolerate, and
reducing risk to that level “. The goal of risk mitigation is to reduce risk to a level acceptable to the
organization. Therefore risk needs to be defined for the organization through risk analysis, business
impact assessment, and/or vulnerability assessment. Answer “Analyzing and removing all
vulnerabilities and threats to security within the organization” is not possible. Answer “Defining the
acceptable level of risk the organization can tolerate, and assigning any costs associated with loss or
disruption to a third party, such as an insurance carrier” is called risk transference. Answer
“Analyzing the effects of a business disruption and preparing the company’s response ” is a
distracter.