What is risk mitigation?

• A. Outsourcing risk management.
• B. Increasing the threat surface.
• C. Accepting all risk.
• D. Taking steps to reduce adverse effects.

Answer: (D)

Risk mitigation means taking deliberate actions to reduce the potential harm from security risks. It focuses on lowering either how likely a risk is to occur or how severe the impact would be if it does occur, so the overall risk stays at an acceptable level. This involves applying safeguards, controls, and procedures such as patching systems, enforcing least privilege, network segmentation, regular backups, and having incident response and disaster recovery plans. By identifying high‑risk areas through assessment and then implementing appropriate measures, you minimize damage when threats manifest. Outsourcing risk management isn’t the mitigation itself; it’s a way to handle the process. Increasing the threat surface would raise risk, not reduce it. Accepting all risk is a different approach that doesn’t reduce risk. So taking steps to reduce adverse effects is the core idea of risk mitigation.