CompTIA Cloud Essentials+ (CLO-002)Governance, Risk, Compliance and SecurityMedium
A pharmaceutical research firm decides that the risk of storing highly sensitive unpublished drug formulas in any third-party cloud environment is unacceptable, regardless of security controls offered. The firm chooses to keep all such data exclusively on isolated, air-gapped on-premises servers with no cloud connectivity. Which risk management strategy does this represent?
- ARisk acceptance
- BRisk mitigation
- CRisk avoidance
- DRisk transfer
Show answer & explanationAnswer & explanation
Correct answer: C. Risk avoidance
Risk avoidance means eliminating the risk entirely by not engaging in the activity that creates it; here the firm avoids cloud storage altogether for this data rather than reducing, shifting, or tolerating the risk.
Why the other options are wrong
- A. Acceptance means tolerating the risk without changing behavior, which contradicts the decision to isolate the data completely.
- B. Mitigation reduces risk while still engaging in the activity, but the firm is not using the cloud for this data at all.
- D. Transfer would involve shifting responsibility to another party, such as through a cloud provider's liability clause, not eliminating cloud use.
Risk Avoidance
A risk response strategy that eliminates exposure to a risk entirely by not engaging in the activity or process that creates it.
- Removes the risk source completely
- Often used for unacceptable or catastrophic risks
- May limit business opportunities or efficiency gains
Memory trick: MATA: Mitigate, Avoid, Transfer, Accept