Which action best exemplifies the mitigation of a security risk within an organization's risk management strategy?
Deciding to stop all activities that are associated with a high level of risk to avoid it completely.
Establishing additional access controls to safeguard sensitive information.
Purchasing an insurance policy to transfer the risk associated with potential data breaches.
Acknowledging the existence of a security risk and choosing not to take corrective actions.