Evaluate and select appropriate risk treatment and risk response options in accordance with the organisation's risk appetite.

A retailer plans to launch a feature that stores customers' biometric templates to speed up sign-in. Assessment shows the resulting residual risk exceeds the board's risk appetite, no available control brings it within appetite, and the feature delivers only a marginal convenience benefit. The information security manager must recommend a risk response. Which response is most appropriate?

• ARecommend layering every available control on the biometric store and accepting whatever residual risk remains, on the basis that thorough mitigation is the responsible engineering choice for sensitive data.
• BRecommend not proceeding with biometric storage and meeting the sign-in goal another way, because the risk cannot be brought within appetite and the benefit does not justify carrying an out-of-appetite exposure.check_circle Correct
• CRecommend transferring the exposure to a specialist biometric processor under contract, so the residual risk becomes the processor's responsibility and the feature can launch as planned.
• DRecommend launching the feature now and revisiting the exposure at the next annual risk review, treating the gap as a temporary deviation that monitoring will keep under control until then.

Why A is wrong: Tempting because stacking controls looks diligent and biometric data clearly warrants strong protection; it is wrong because the assessment already shows no control combination reaches appetite, so accepting the remainder still breaches appetite.

Why B is correct: Correct because when no control reduces the residual risk to within appetite and the benefit is marginal, avoidance by removing the risky activity is the only response that keeps the organisation within its stated appetite.

Why C is wrong: Tempting because outsourcing the processing appears to shift the burden to a specialist; it is wrong because the retailer stays accountable for customers' biometric data and the residual risk still exceeds its own appetite.

Why D is wrong: Tempting because deferring with monitoring feels pragmatic for a new feature; it is wrong because monitoring an exposure that already exceeds appetite does not reduce it, so the organisation knowingly operates out of appetite.