Risk Mitigation — Technical Controls and Compensating Controls
A multinational corporation has recently experienced a significant increase in phishing attacks targeting its employees. The attacks have caused several data breaches, resulting in regulatory fines and reputational damage. The organization has implemented security awareness training for all employees, but the number of successful attacks remains high. Additionally, the organization's risk appetite for cybersecurity incidents is Low. The CRO has asked you to recommend a risk response. You have the following options:
A. Accept the risk because the training has reduced the likelihood, and further controls are too expensive. B. Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP). C. Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks. D. Avoid the risk by discontinuing the use of email for business communications.
Which course of action is most appropriate given the organization's risk appetite and the current situation?
Quick Answer
The correct choice is C, implementing technical controls like advanced email filtering and multi-factor authentication, because this directly addresses the organization’s low risk appetite by reducing both the likelihood and impact of phishing attacks through risk mitigation. While security awareness training is a compensating control that modifies behavior, it has proven insufficient on its own; technical controls such as SPF, DKIM, and DMARC validation block malicious emails at the gateway, and MFA neutralizes credential theft, thereby lowering residual risk to an acceptable level. On the CRISC exam, this scenario tests your ability to match a risk response to the organization’s risk appetite and the effectiveness of existing controls—a common trap is choosing transfer (option B) without verifying that outsourcing alone reduces likelihood, or accepting risk (option A) when appetite is low. Remember the memory tip: “Train the mind, but lock the gate”—training alone is a compensating control, but technical controls are the primary mitigation when appetite is low.
⚠ Common exam trap
Many candidates choose Option D (transfer) thinking outsourcing removes all risk, but in reality, the organization retains accountability for breaches and regulatory fines, making mitigation (Option C) the most appropriate response given the low risk appetite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
Implementing technical controls like advanced email filtering (e.g., SPF, DKIM, DMARC validation) and multi-factor authentication (MFA) directly reduces both the likelihood and impact of phishing attacks. Given the organization's low risk appetite for cybersecurity incidents, this risk mitigation approach aligns with the need to lower residual risk to an acceptable level, especially since training alone has proven insufficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Avoid the risk by discontinuing the use of email for business communications.
Why it's wrong here
Incorrect: Avoidance is impractical and would severely impact business operations.
- ✗
Accept the risk because the training has reduced the likelihood, and further controls are too expensive.
Why it's wrong here
Incorrect: Attacks are still high, and low risk appetite makes acceptance unacceptable.
- ✓
Implement technical controls such as advanced email filtering and multi-factor authentication (MFA) to reduce the likelihood and impact of phishing attacks.
Why this is correct
Correct: Technical controls directly reduce likelihood and impact, aligning with low risk appetite.
- ✗
Transfer the risk by outsourcing all email and security operations to a managed security service provider (MSSP).
Why it's wrong here
Incorrect: Transfer does not eliminate residual risk; human factor remains and MSSP may not fully address phishing.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
6 more ways this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A risk assessment reveals that a legacy system has a high likelihood of failure. The system is critical and cannot be replaced immediately. The company decides to implement manual overrides and additional monitoring. This is an example of:
medium- A.Risk Transfer
- ✓ B.Risk Mitigation
- C.Risk Acceptance
- D.Risk Avoidance
Why B: Implementing manual overrides and additional monitoring reduces the probability or impact of the legacy system failure without eliminating the risk entirely. This is the definition of risk mitigation, as it applies controls to lower the residual risk to an acceptable level while the system remains in operation.
Variation 2. A company is implementing a new cloud-based customer relationship management (CRM) system. The risk manager has identified that the vendor's security controls may not meet the company's requirements. Which of the following is the BEST way to address this risk?
hard- A.Deny the existence of the risk
- B.Purchase cyber insurance to cover potential losses
- C.Avoid using the cloud CRM system
- ✓ D.Include security requirements in the contract and perform regular vendor audits
Why D: Including security requirements in the contract and conducting regular vendor audits ensures the vendor meets the company's security standards, effectively mitigating the risk. Option A is incorrect because denying the existence of the risk is not a valid risk response. Option B is incorrect because purchasing cyber insurance transfers the financial impact but does not reduce the actual risk. Option C is incorrect because avoiding the CRM system may be too drastic and could hinder business operations.
Variation 3. Based on the exhibit, what is the primary risk response strategy demonstrated by this firewall rule?
easy- A.Risk Transfer
- B.Risk Acceptance
- ✓ C.Risk Mitigation
- D.Risk Avoidance
Why C: The firewall rule denies inbound traffic on TCP port 443 (HTTPS) from any source to any destination. This directly reduces the attack surface by blocking a specific protocol, which is a classic risk mitigation action. By implementing a technical control to reduce the likelihood or impact of a threat, the organization is applying risk mitigation, not transferring, accepting, or avoiding the risk entirely.
Variation 4. Based on the exhibit, which risk is most likely present and what is the most appropriate risk response?
hard- A.Risk of cost; set a budget alert
- ✓ B.Risk of data exposure; apply a deny rule to restrict access
- C.Risk of availability; implement backup
- D.No risk; the policy is standard
Why B: The exhibit shows a cloud storage access policy that allows public access via a wildcard permission with an allow effect. This directly exposes data to the internet, creating a risk of unauthorized data exposure. The most appropriate risk response is to apply a deny rule to restrict access, such as modifying the policy to remove the wildcard permission or adding conditions to block public access.
Variation 5. Based on the exhibit, which risk response should be prioritized?
medium- ✓ A.Implement account lockout policy
- B.Avoid by taking the server offline
- C.Accept the risk because it's only a single server
- D.Transfer the risk to a cloud provider
Why A: The exhibit indicates a single server with a known vulnerability that could lead to unauthorized access. Implementing an account lockout policy directly mitigates the risk of brute-force attacks by limiting the number of failed login attempts, which is a cost-effective and immediate control. This aligns with the risk response strategy of mitigation, reducing the likelihood of exploitation without the operational impact of taking the server offline.
Variation 6. An organization uses a legacy system that cannot be patched because the vendor is defunct. The system supports a core business function. The risk assessment shows a high likelihood of exploitation and high impact. The board has decided to keep the system operational due to its criticality. Which risk response should the risk manager recommend?
hard- A.Accept the risk
- ✓ B.Implement compensating controls
- C.Transfer via insurance
- D.Avoid by decommissioning
Why B: When a legacy system cannot be patched and the risk is high, compensating controls are the most appropriate response to reduce the residual risk to an acceptable level. Compensating controls, such as network segmentation, strict access controls, or an application-layer firewall, mitigate the exploitation vector without decommissioning the critical system. The board's decision to keep the system operational means avoidance is not an option, and acceptance alone would leave the organization exposed to an unacceptable risk level.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.