Watch this video on YouTube
What should the information security manager recommend when the cost to mitigate a risk is much greater than the benefit?