Exam CCAK topic 1 question 244 discussion

D. Risk reduction The organization continues to use the SaaS but does NOT process secret customer data in it It's same like the example in study guide, page 60: Continue using the CRM but do not process top-secret data in that SaaS solution The organization is not adding technical controls like MFA, therefore it is NOT risk mitigation

C. Risk mitigation The scenario describes a situation where the organization continues to use the SaaS service but avoids processing secret customer data to prevent disclosure to unauthorized parties. By not processing the sensitive data, the organization is reducing the potential impact of the risk. This approach aligns with risk mitigation, which involves taking steps to reduce either the likelihood or the impact of a risk to an acceptable level. In this case, the organization is mitigating the risk by altering its operations to avoid exposing sensitive data while still using the SaaS service for other purposes.