Responding to findings may mean mitigating, transferring, avoiding or:

1. A finding does not always require a technical fix. 2. Sometimes the exposure is simply carried. 3. Respond to findings with mitigating activities or acceptance, transference or avoidance. 4. So the answer is accepting risk. _Source: NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems and Organizations'_