IT Risk Fundamentals

Risk avoidance removes the activity, condition, or exposure that creates an unacceptable risk. Relocating the data center outside the flood zone eliminates exposure to the flood hazard, rather than retaining the exposure and reducing its effects through controls. NIST identifies avoiding as a risk-response option and describes avoidance as actions that eliminate or reposition activities or technologies that are the basis for risk.