In the context of disaster recovery planning, which activity would be classified under risk transference?

• A. Outsourcing operations to a third party
• B. Building redundancy within a single data center
• C. Implementing a backup solution for disks
• D. Conducting in-house security training

Answer: (A)

Transferring risk means shifting responsibility for handling certain threats to another party, typically through a contract or service arrangement. Outsourcing operations to a third party does exactly that: the provider takes on the operational and disaster recovery responsibilities under a formal agreement, effectively moving the risk from your organization to the vendor. The other options focus on reducing risk within your own environment—creating redundancy in one data center, implementing backups, and providing in-house security training are all mitigation or preparedness measures aimed at lessening impact or improving recoverability, not shifting who bears the risk. It's worth noting that outsourcing introduces vendor risk and requires careful contract terms and oversight, but it remains the classic example of risk transference in disaster recovery planning.