ISC2 Certified in Cybersecurity (CC) Practice Question

Transference (also called risk sharing) shifts the financial consequences of a threat to a third party rather than trying to reduce the likelihood or impact internally. Purchasing a cyber-liability insurance policy is a classic example because the insurer, for a fee, assumes part of the potential loss. Implementing redundant power supplies attempts to lessen impact and is therefore mitigation. Decommissioning and removing a vulnerable application eliminates the exposure, demonstrating avoidance. Simply living with minor downtime is risk acceptance because no additional control or external party is engaged.