Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation

Section: INFORMATION RISK MANAGEMENT
Explanation:
Risk should be reduced to an acceptable level based on the risk preference of the organization. Reducing risk to zero is impractical and could be cost-prohibitive. Tying risk to a percentage of revenue is inadvisable since there is no direct correlation between the two. Reducing the probability of risk occurrence may not always be possible, as in the ease of natural disasters. The focus should be on reducing the impact to an acceptable level to the organization, not reducing the probability of the risk.

Section: INCIDENT MANAGEMENT AND RESPONSE

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
If there are many firewall rules, there is a chance that a particular rule may allow an external connection although other associated rules are overridden. Due to the increasing number of rules, it becomes complex to test them and. over time, a loophole may occur.