A business unit is planning to replace an existing IT legacy solution with a hosted Software as a Service (SaaS) solution. However, business management is concerned that stored data will be at risk. W

Researching technology and identifying threats is an initial step, but it doesn't *reduce* the risk; it only identifies it.

Including risk-related requirements in the SaaS contract legally binds the provider to specific security measures, data protection standards, and incident response procedures. This approach proactively addresses concerns by embedding security into the service agreement and provides legal recourse if the provider fails to uphold their commitments.

Creating KRIs helps monitor risk levels over time, but it doesn't *reduce* the inherent risk of the data being at risk in the first place, nor does it enforce security controls.

Redefining risk appetite and tolerance changes the organization's acceptance level for risk, but it does not technically reduce the actual risk itself for the SaaS solution.