(A) Incorrect — the hospital IS taking action (encrypting), not accepting the risk as-is.

(B) Incorrect — the hospital continues using portable devices; it did not eliminate them.

(D) Incorrect — implementing encryption internally is mitigation, not transfer to a third party.

(A) Incorrect — qualitative assessments are widely used and endorsed by frameworks like NIST and ISO 27001.

(C) Incorrect — qualitative and quantitative methods often produce different rankings due to different evaluation criteria.

(D) Incorrect — quantitative methods apply to both physical and cyber risks.

(A) Insufficient — replacement cost ignores fines, reputation, and patient care impact, which likely exceed the rebuild cost.

(C) Inappropriate — valuing records at their black market price is not a standard risk assessment methodology.

(D) Insufficient — insurance payout is a risk transfer amount, not the full asset value.

(A) Incorrect — alphabetical ordering has no relationship to risk severity.

(B) Incorrect — recency does not correlate with urgency; a years-old unpatched critical vulnerability outranks a new low-risk finding.

(D) Incorrect — fixing cheap, low-impact risks while ignoring expensive high-impact risks leaves the organization exposed to its greatest threats.

(A) Incorrect — the threat landscape changes constantly; annual-only assessment creates dangerous blind spots.

(B) Incorrect — mid-cycle updates strengthen the assessment; they do not invalidate it.

(D) Incorrect — the risk register must be formally updated to reflect new threat intelligence; informal awareness is insufficient.