A company recently replaced its unsecure email server with a cloud-based email and collaboration solution that is managed and insured by a third party. Which of the following actions did the company…

Risk transference involves shifting the financial or operational burden of a risk to another party, such as a third-party vendor or insurer. By adopting a cloud-based solution that is both managed and insured by a third party, the company has transferred responsibility for securing and guaranteeing the email service away from itself. The insurance component is a key indicator of transference, as it explicitly moves financial liability to an outside entity.

Acceptance means the company acknowledges the risk and chooses to do nothing about it, which is not the case here since the company actively replaced its insecure server with a third-party solution.

Mitigation involves reducing the likelihood or impact of a risk through internal controls or improvements, but moving to a fully managed and insured third-party service transfers rather than internally reduces the risk.

Deterrence involves discouraging threat actors from targeting the organization through warnings or consequences, which has no relevance to replacing an email server with a cloud-based managed service.