According to NIST SP 800-39, Managing Information System Risk, when an organization responds to risk by eliminating the activity or technology that are the basis for the risk, that organization is…

NIST SP 800-39, 'Managing Information System Risk,' defines risk avoidance as the decision to eliminate the activity or technology that is the basis for the risk. By removing the source, the organization entirely prevents the associated potential negative impacts and likelihood of occurrence.

Accepting the risk means acknowledging the risk and taking no action to reduce it, often because mitigation costs outweigh potential losses.

Transferring the risk involves shifting the risk to another party, typically through insurance or outsourcing, rather than eliminating the activity itself.

Mitigating the risk involves implementing controls or taking actions to reduce the likelihood or impact of the risk, not removing the underlying activity.