What should happen when a business declines to fund a security control?
- A Document the risk acceptance formally and move on
- B Implement it anyway
- C Escalate to regulators
- D Resign from the project
Answer
Document the risk acceptance formally and move on
Documented risk acceptance makes the decision explicit and owned. Treating every rejection as a battle erodes influence over time.





