A Company Has Completed the Implementation of Technical and Management

Multiple Choice

A company has completed the implementation of technical and management controls as required by its adopted security policies and standards. The implementation took two years and consumed all the budget approved to security projects. The board has denied any further requests for additional budget. Which of the following should the company do to address the residual risk?

A) Transfer the risk
B) Baseline the risk
C) Accept the risk
D) Remove the risk