What is risk limitation?

• A. A strategy that eliminates all risks entirely.
• B. A strategy that ignores risk.
• C. A strategy that transfers risk to customers.
• D. A strategy that limits a company's exposure by taking some action, combining aspects of risk acceptance and avoidance.

Answer: (D)

Risk limitation means reducing how much exposure a company has to threats by taking concrete actions. It assumes you can’t erase all risk, but you can lower either the likelihood of an incident or the impact if one occurs, thereby keeping overall risk at an acceptable level. This approach blends accepting some residual risk after controls with actively avoiding or reducing exposure to the riskiest activities. For example, you might allow remote work to support business needs (accepting some risk) while enforcing strong measures like MFA, patching, network segmentation, and least-privilege access to limit potential damage. It isn’t about ignoring risk, nor about transferring it to customers or eliminating it entirely; those would be other strategies like avoidance, transfer, or mitigation.