In terms of risk mitigation, the decision to accept the risk is a form of risk management, i.e., to leave things the way they are without seeking any additional security controls to further mitigate risks. The followings are situations where there are sufficient reasons to adopt this stand, i.e.: Basic risk is acceptable Candidate security control does not mitigate sufficient risk. Economic feasibility Social feasibility Operational feasibility Ethical and legal feasibility Technical feasibility