According to the CompTIA Cloud Essentials+ Study Guide, risk response is the process of developing
and implementing strategies to address the identified risks in a cloud project1. There are four types
of risk response strategies: acceptance, transference, avoidance, and mitigation1. Each strategy has
its own advantages and disadvantages, depending on the nature and impact of the risk.
Acceptance is the strategy of acknowledging the risk and its consequences, without taking any action
to reduce or eliminate it. This strategy is suitable for risks that have low probability and low impact,
or for risks that are unavoidable or too costly to address. Acceptance can be passive, where no
contingency plans are prepared, or active, where some reserves or fallback options are allocated1.
Transference is the strategy of shifting the risk and its responsibility to a third party, such as a cloud
service provider, an insurance company, or a subcontractor. This strategy is suitable for risks that
have high impact but low probability, or for risks that require specialized skills or resources to handle.
Transference does not eliminate the risk, but it reduces the exposure and liability of the
organization. However, transference also involves some costs and trade-offs, such as loss of control,
dependency, or contractual issues1.
Avoidance is the strategy of eliminating the risk and its causes, by changing the scope, plan, or
design of the cloud project. This strategy is suitable for risks that have high probability and high
impact, or for risks that are unacceptable or intolerable for the organization. Avoidance can be
effective in removing the threat, but it can also result in missed opportunities, reduced benefits, or
increased costs1.
Mitigation is the strategy of reducing the probability and/or impact of the risk, by implementing
some preventive or corrective actions. This strategy is suitable for risks that have moderate
probability and impact, or for risks that can be controlled or minimized. Mitigation can be proactive,
where actions are taken before the risk occurs, or reactive, where actions are taken after the risk
occurs1.
In the given scenario, an organization determines it cannot go forward with a cloud migration due to
the risks involved. This describes the avoidance strategy, as the organization is eliminating the risk
and its causes by changing the plan of the cloud project. The organization is avoiding the potential
negative consequences of the cloud migration, but it is also foregoing the potential benefits and
opportunities of the cloud adoption. Reference: 1: https://www.comptia.org/training/books/cloudessentials-clo-002-study-guide, Chapter 7, page 241-243
