A transit agency faces ransomware risk against fare-collection servers. Leadership wants to reduce both likelihood of compromise and impact of encryption. Which action set best illustrates risk mitigation?

Risk mitigation applies controls that reduce likelihood, impact, or both until residual risk is acceptable. For ransomware against transit fare-collection servers, enforcing multifactor authentication on administrative access lowers the likelihood of credential-driven compromise, while maintaining tested offline or immutable backups reduces the impact of encryption by enabling recovery without paying a ransom. Together those controls illustrate mitigation aimed at both dimensions leadership asked to improve. Writing a press release denying that ransomware exists is denial and communications spin. It does not reduce technical likelihood or impact and can worsen preparedness by discouraging investment in real controls. Transferring ownership of fare servers to an unpaid intern neither transfers financial risk in the insurance sense nor mitigates ransomware. Inappropriate ownership can increase risk by placing critical systems under inadequate stewardship. Accepting the risk silently and disabling all logging combines improper undocumented acceptance with active weakening of detection. Turning off logging increases impact and response difficulty; it is the opposite of mitigation. Exam caveat: Mitigation must meaningfully reduce likelihood and/or impact through controls. Public denial, reckless ownership changes, and disabling monitoring are not mitigation even if worded to sound decisive. Operational check: Verify MFA coverage on all fare-system admin paths, test offline backup restore regularly, measure residual ransomware risk after those controls, and keep logging enabled for detection and investigation.