Which of the following is an example of risk mitigation?

Risk mitigation, also known as risk reduction, is the process of implementing controls and countermeasures to reduce the likelihood or impact of a risk to an acceptable level. Improving security controls, such as implementing stronger authentication, enhancing firewalls, or deploying intrusion detection systems, is a direct action taken to lessen the potential for a threat to exploit a vulnerability. This action actively reduces the residual risk associated with an activity, which is the fundamental goal of risk mitigation.

A. Purchasing insurance is an example of risk transfer (or sharing), where the financial consequence of a risk is shifted to a third party.

B. Discontinuing the activity associated with the risk is an example of risk avoidance, which eliminates the risk by ceasing the action that generates it.

D. Performing a cost-benefit analysis is a decision-support process used to evaluate and select a risk response option, not a risk response itself.

1. ISACA. (2022). CISM Review Manual

16th Edition. Domain 2: Information Risk Management

Section 2.5 Risk Response/Risk Treatment. The manual explicitly defines risk mitigation as "the application of controls to reduce the risk" and distinguishes it from other responses like risk avoidance (discontinuing activity) and risk transfer (e.g.

insurance).

2. National Institute of Standards and Technology (NIST). (2018). Special Publication (SP) 800-37

Revision 2: Risk Management Framework for Information Systems and Organizations. Appendix F

Section F.3 Risk Response. This document lists "Mitigate" as a primary risk response

defining it as implementing controls to reduce the likelihood or impact of a risk. It separately defines "Share" (transfer) and "Avoid."

3. Fenz

S.

& Ekelhart

A. (2011). Formalizing Information Security Risk Management. In Availability

Reliability

and Security in Information Systems and HCI (pp. 35-49). Springer

Berlin

Heidelberg. This academic publication discusses risk treatment strategies

identifying risk reduction (mitigation) through the implementation of security controls as a core strategy

distinct from risk avoidance

transfer

and acceptance. (DOI: https://doi.org/10.1007/978-3-642-23338-83

Section 2.3).