CRISC Risk Response and Mitigation Practice Question
A hospital's risk team has documented that its infusion pump fleet runs an unsupported operating system, creating a high risk of compromise. Replacing the pumps requires capital approval that will take 18 months, and the pumps cannot be taken offline in the interim. Which risk response is MOST appropriate for the risk practitioner to recommend?
⚠ Common exam trap
The trap here is assuming that because the root fix is delayed, the only options are accept or avoid, when compensating controls can meaningfully reduce risk in the interim.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement compensating controls such as network segmentation and strict access controls until the pumps are replaced.
The best response is to reduce risk through compensating controls while the long-term replacement is planned. Because the pumps cannot be removed and replacement is 18 months away, the risk practitioner should recommend interim mitigation that lowers exposure without disrupting patient care. This aligns with the CRISC principle of selecting a response proportionate to risk and maintaining operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement compensating controls such as network segmentation and strict access controls until the pumps are replaced.
Why this is correct
When the primary fix (replacement) is delayed, compensating controls reduce likelihood and impact in the interim. Segmenting the pumps onto a dedicated VLAN, restricting inbound/outbound traffic, and enforcing least-privilege access directly lower the exposure of the unsupported OS. This is a practical mitigation that maintains clinical availability while the capital project proceeds.
- ✗
Avoid the risk by immediately decommissioning all infusion pumps and switching to manual dosing.
Why it's wrong here
Avoidance eliminates the activity generating the risk, but here it would eliminate a critical clinical capability. Manual dosing introduces medication errors and cannot handle patient volume, creating a larger safety risk. Avoidance is not viable when the process is essential and no acceptable substitute exists, so it is not the appropriate recommendation.
- ✗
Accept the risk and log it in the risk register for the next annual review.
Why it's wrong here
Acceptance is not appropriate because the risk level exceeds the hospital's tolerance and clinical impact could be severe. Acceptance is reserved for low or tolerable risks, or when no cost-effective treatment exists. Simply logging the risk for an annual review leaves the pumps unprotected for 18 months and does not satisfy due diligence obligations for patient safety.
- ✗
Transfer the risk by purchasing cyber liability insurance that covers medical device incidents.
Why it's wrong here
Insurance transfers some financial consequence but does not reduce the likelihood of a pump compromise, nor does it protect patient safety. The scenario's core concern is operational and clinical risk, not just financial loss. Transfer alone leaves the unsupported devices exposed and does not address the root vulnerability, so it is insufficient as the primary response.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.