After a risk assessment, management decides to discontinue an online service that handled sensitive customer data because the cost of securing it would exceed the revenue it earns. Which risk response does this represent?
Select an answer to reveal the explanation.
Short Explanation
If the pool's too risky, you can fence it, insure it, live with it, or fill it in. Shutting the service down is filling in the pool: risk avoidance. Don't mix it up with acceptance, which means keeping the activity and living with the risk.
Full Explanation
Risk avoidance means eliminating a risk by ceasing or not starting the activity that creates it. Discontinuing the online service removes the exposure of the sensitive customer data it handled, which is a deliberate business decision based on cost and value. Avoidance is appropriate when the benefits of an activity do not justify the cost of reducing its risk to an acceptable level, which is exactly what the assessment found. Acceptance would keep the service running and consciously bear the risk, typically when it is within appetite or treatment is not cost-effective, but the activity continues. Transfer, or sharing, would keep the service running while moving part of the financial consequences to a third party, such as an insurer or an outsourced provider, without removing the underlying exposure. Mitigation would keep the service and apply controls to reduce likelihood or impact to an acceptable level, which management has rejected on cost grounds. Exam caveat: avoidance carries its own consequences, such as lost revenue or customer goodwill, and it must be decided by business management, not imposed by security. Operational check: confirm the decommissioning plan covers secure disposal or migration of the customer data so that the risk is actually eliminated.