Risk avoidance removes a specific risk by discontinuing the activity or system that creates it, or by changing its process, strategy, or technology. section 5.3.1
Apply risk avoidance when an organization decides the threat cannot be tolerated or adequately reduced.
- Discontinue high-risk activities, avoid vulnerable technologies, change risky processes, or exit markets with threat levels the organization cannot accept. section 5.3.1 section 8.1.3
- Prioritize avoidance for critical vulnerabilities that could threaten operations, after considering risk effect, threat likelihood, and organizational risk tolerance. section 5.3.1 section 8.1.3
Declining online financial transactions
An organization determines that online financial transactions create cyber risks too high to mitigate or transfer, so it chooses not to offer them. The decision prevents that threat from emerging through the discontinued activity. section 8.1.3
