The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage; and realizes this is a risk to the company. In response, the…

Risk avoidance would mean eliminating the activity entirely, such as blocking all access to public cloud storage services - not educating employees on how to use it properly.

Risk acceptance means acknowledging the risk and choosing to take no action; implementing a training program is an active response, not passive acceptance.

Risk mitigation involves taking action to reduce the probability or impact of a risk. By deploying mandatory training, the CISO directly addresses the risky behavior - improper cloud storage use - with a control that makes employees more aware of policy and less likely to expose sensitive data. The risk still exists but is reduced in likelihood through this corrective measure.

Risk transference shifts the financial or operational burden of a risk to a third party, such as purchasing cyber insurance - training employees does not transfer the risk to another entity.