A retailer runs its loyalty platform on a public IaaS provider and classifies customer purchase histories as confidential. The board has set a low risk appetite for any breach of that data, but a recent assessment found that a residual risk of misconfigured storage buckets still exceeds that appetite even after the retailer hardened its own controls. The provider will not change the underlying service. Which risk treatment option most directly closes the gap between residual risk and the stated appetite?
- AAccept the residual risk formally, because the retailer has already applied its own hardening controls and the provider owns the storage service.
- BMitigate further by adding tenant-side controls such as enforced encryption, blocked public access, and continuous configuration monitoring until residual risk falls within appetite. Correct
- CTransfer the residual risk to the provider by relying on the shared responsibility model, since bucket security is the cloud provider's obligation in IaaS.
- DAvoid the risk by migrating the entire loyalty platform back on premises, removing the cloud storage exposure completely.
Why A is wrong: Acceptance is only valid when residual risk sits within appetite; here it explicitly exceeds the board's low appetite, so acceptance would leave the organisation knowingly out of tolerance.
Why B is correct: Additional mitigation at the layer the customer controls reduces the likelihood and impact of exposure, which is the direct way to bring residual risk down to the board's stated appetite.
Why C is wrong: In IaaS the customer configures and secures its own storage, so responsibility cannot be transferred to the provider this way; the model assigns configuration to the tenant, not the vendor.
Why D is wrong: Avoidance eliminates the exposure but is disproportionate to a gap that further tenant-side controls can close, discarding the cloud benefits the board endorsed rather than treating the specific residual risk.