ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Enterprise risk-management frameworks such as ISO 31000 and NIST SP 800-30 describe four main ways to address identified risks:

• Avoid: eliminate the activity causing the risk.
• Transfer/Share: shift the impact to another party (for example, via insurance or contractual clauses).
• Mitigate (Reduce): implement controls that lower the likelihood or impact of the risk to an acceptable level.
• Accept: take no further action and simply acknowledge the risk.

In this scenario the company will still use the public cloud, so it is not avoiding the risk. It is not buying insurance or contractually shifting liability, so it is not transferring the risk. Nor is it choosing to leave the risk unchanged, so it is not accepting it. Instead, by adding encryption with customer-managed keys and keeping the crown-jewel files on premises, the organization is introducing controls specifically intended to lower the residual confidentiality risk. That approach fits the definition of risk mitigation (risk reduction).