After a risk assessment, leadership decides not to migrate a sensitive research workload to any public cloud because no available provider can meet a data residency requirement, and the workload will remain on premises. Which risk treatment has leadership chosen, and what is its main trade-off?
Select an answer to reveal the explanation.
Short Explanation
If you're worried about sharks, you can just stay out of the water; you won't get bitten, but you won't get to swim either. That's risk avoidance: you skip the activity that creates the risk and give up whatever it would have gained you. Don't confuse it with acceptance, since the residency risk never comes into existence here.
Full Explanation
Risk avoidance eliminates a risk by not undertaking, or by discontinuing, the activity that gives rise to it. By keeping the workload on premises, leadership removes the data residency risk associated with public cloud hosting entirely. The trade-off is opportunity cost: the organization forgoes the expected benefits of the migration, such as elasticity, reduced capital spending or faster delivery, and the on-premises environment keeps whatever risks it already had. Mitigation would mean proceeding with the migration while applying controls to reduce likelihood or impact, for example a provider region within the required jurisdiction plus customer-held keys; here the migration is not happening at all. Risk transfer moves financial impact to a third party such as an insurer or contractor; nothing is transferred when a workload stays in-house, and no provider duties pass to internal staff. Acceptance means knowingly retaining a risk; because the cloud migration is cancelled, the residency risk is never taken on, so there is nothing to accept and record. Exam caveat: avoidance is appropriate when a risk exceeds appetite and cannot be reduced cost-effectively, but it should be revisited as provider offerings change. Operational check: record the decision, its rationale and a review date in the risk register.