A security manager must recommend treatment for a low-impact risk whose mitigation cost far exceeds expected benefit. What is the best approach?

1. Ignore every low-impact risk without review
2. Mandate the most expensive control in all cases
3. Ask the vendor to define the organization's tolerance
4. Compare acceptance or proportionate alternatives with the authorized risk criteria