An organization has established a contract with a vendor that includes penalties for loss of availability. Which risk treatment has been adopted by the organization?

Acceptance means acknowledging a risk and taking no action to reduce or mitigate its impact or likelihood, which is not the case when contractual penalties are established.

Avoidance means eliminating the risk by choosing not to engage in the activity that creates it, which is contrary to establishing a contract with a vendor.

Risk transfer involves shifting the financial consequences or operational responsibility of a risk to another party, typically through contractual agreements like penalties for non-performance by a vendor. In this scenario, the organization transfers part of the risk's financial burden to the vendor by embedding penalty clauses in the contract for availability losses.

Reduction involves implementing controls to lessen the likelihood or impact of a risk event, whereas contractual penalties deal with the financial consequence after an event occurs.