What is the stated goal of IT security?

• A. Risk elimination
• B. Reasonable risk reduction
• C. No risk
• D. Only legal compliance

Answer: (B)

The aim of IT security is to reduce risk to a level that is reasonable given the organization's resources and risk tolerance. In practice, this means identifying critical assets, evaluating threats and vulnerabilities, and applying controls that lower both the likelihood of a breach and the potential impact if one occurs. The goal isn’t to eliminate risk completely—threats evolve, there are limits to what controls can achieve, and perfect security would be prohibitively costly and burdensome for users. Instead, security seeks a balance between protection, usability, and cost, aligning with business priorities and risk appetite. Compliance is important, but it represents a baseline; being compliant doesn’t automatically guarantee safety if residual risk remains at an unacceptable level. So the stated goal is reasonable risk reduction.