Which best describes risk transfer?

• A. Implementing security controls to reduce risk.
• B. Accepting risk without action.
• C. Shifting risk to another party, for example insurance or outsourcing.
• D. Eliminating the asset.

Answer: (C)

Risk transfer is moving the financial consequences of a potential loss to someone else through a contract or agreement. By transferring, you shift responsibility for those losses to another party in exchange for a premium or service fee. That’s why the best description is shifting risk to another party, for example through insurance or outsourcing. It doesn’t reduce how likely the event is or how severe the loss could be; it just changes who would pay for it. Other approaches, like putting in security controls, aim to reduce risk; accepting risk means taking no action; eliminating the asset removes exposure but doesn’t transfer risk to someone else.