A company should consider list of possible remediation plans as an investment portfolio.

• A. True
• B. False
• C. Depends on budget
• D. Only for major gaps

Answer: (A)

Treating remediation options as an investment portfolio means evaluating each possible action by its cost and its expected impact on risk, then choosing a mix that maximizes risk reduction within available resources. This approach lets you compare how different controls complement or overlap with each other, sequence what to implement first, and see how changes in budget affect the overall security posture. It also helps communicate justification to management by showing a coherent plan that balances value, timing, and risk reduction, rather than chasing individual fixes in isolation. The portfolio view is useful across all budget levels, since you can prioritize the highest-value actions first or expand the portfolio as funds become available.