Avoiding the risk means eliminating the source of the risk or changing the likelihood or impact to zero. In this case, the source of the risk is the collection of customers’ personally identifiable information (Pll), which could be exposed to unauthorized parties and result in severe fines. Therefore, the best action to avoid the risk is to modify the business processes to stop collecting Pll, as this would eliminate the possibility of data leakage and the associated consequences. The other options are not as effective as modifying the business processes, because they do not avoid the risk, but rather mitigate or transfer the risk, as explained below:
A. Reduce retention periods for Pll data is a mitigation action, as it reduces the impact of the risk by minimizing the amount of data that could be leaked and the duration of exposure.
B. Move Pll to a highly-secured outsourced site is a transfer action, as it shifts the responsibility of protecting the data to a third party, but does not eliminate the risk of data leakage.
D. Implement strong encryption for Pll is a mitigation action, as it reduces the likelihood of the risk by making the data unreadable to unauthorized parties, but does not eliminate the risk of data leakage. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, page 40.
