CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
A global technology company has outsourced its entire IT infrastructure to a major cloud service provider (CSP). The service level agreement (SLA) with the CSP specifies strict uptime guarantees, data residency requirements, and security incident response times. However, the company's risk assessment reveals that while the CSP is generally secure, a catastrophic regional outage at the CSP's data centers could still lead to significant business disruption for the company, even with the SLA in place. The company decides to implement a multi-cloud strategy, distributing critical workloads across different CSPs in separate geographical regions. This decision is an example of which risk response strategy?
- ARisk Mitigation
- BRisk Acceptance
- CRisk Transfer
- DRisk Avoidance
Show answer & explanationAnswer & explanation
Correct answer: A. Risk Mitigation
Implementing a multi-cloud strategy to distribute workloads across different providers and regions is a clear action taken to reduce the impact of a single point of failure (a catastrophic regional outage). This directly reduces the potential impact of the risk, which is a form of risk mitigation.
Why the other options are wrong
- B. Risk acceptance would mean continuing with a single CSP and simply living with the potential for a catastrophic regional outage.
- C. Risk transfer (e.g., through insurance or the SLA itself) shifts some financial burden, but the multi-cloud strategy actively reduces the operational impact, which is mitigation.
- D. Risk avoidance would mean not using cloud services at all, or not having critical workloads, which is not the case.
Risk Mitigation (Impact Reduction)
Risk mitigation, specifically focused on impact reduction, involves implementing measures to lessen the severity of consequences if a risk event occurs.
- Aims to reduce the severity of loss or disruption.
- Often involves redundancy, disaster recovery, or business continuity planning.
- Distinguished from likelihood reduction, which prevents the event.
Memory trick: Mitigate by Making the hit less hard.