Which is an example of risk limitation?

• A. Outsourcing all IT operations to a vendor.
• B. Not backing up data at all.
• C. Accepting that a disk drive may fail and having backups to avoid long periods of failure.
• D. Using a single point of failure.

Answer: (C)

Risk limitation means putting controls in place to reduce the impact if a threat occurs, so the organization can continue with minimal disruption. Having backups for data and planning to recover quickly is a classic way to limit consequences when a disk drive fails. By recognizing a possible failure but ensuring data can be restored and operations resumed promptly, you cap downtime and data loss, which is exactly what risk limitation aims to achieve.

Outsourcing all IT operations might shift some responsibilities elsewhere, but it doesn’t inherently limit risk and can introduce new vendor-related risks. Not backing up data at all outright increases risk rather than limiting it. Using a single point of failure concentrates risk instead of reducing its impact.