{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/risk-avoidance","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/risk-avoidance/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/risk-avoidance/"},"term":{"en":"Risk avoidance","da":"Risikoundgåelse"},"aka":{"en":["risk elimination","risk termination"],"da":["risikoeliminering","afvisning af risiko"]},"domain":["security"],"cluster":"risk-management","layer":"governance","status":"current","summary":{"en":"Removing a risk entirely by not doing, or no longer doing, the activity that creates it.","da":"At fjerne en risiko helt ved ikke at udføre, eller holde op med at udføre, den aktivitet, der skaber den."},"body":{"formal":{"en":"The risk treatment option in which the organisation decides not to start, or to stop, the activity, system or data handling that gives rise to the risk, so the risk no longer exists.","da":"Den håndteringsmulighed, hvor organisationen beslutter ikke at starte, eller at stoppe, den aktivitet, det system eller den databehandling, der giver anledning til risikoen, så risikoen ikke længere findes."},"plain":{"en":"Like selling the trampoline because the children keep getting hurt - no more jumping, but also no more broken arms.","da":"Som at sælge trampolinen, fordi børnene bliver ved med at slå sig - ikke flere hop, men heller ikke flere brækkede arme."},"inPractice":{"en":"A fitness chain finds an old database of former members that nobody uses; rather than protect it, it deletes it - data it no longer holds cannot leak.","da":"En fitnesskæde finder en gammel database over tidligere medlemmer, som ingen bruger; i stedet for at beskytte den sletter kæden den - data, man ikke længere har, kan ikke lække."},"whyItMatters":{"en":"It is the only option that removes a risk completely, but it also gives up whatever value the activity had, so it suits risks that bring the business little gain.","da":"Det er den eneste mulighed, der fjerner en risiko helt, men man opgiver også den værdi, aktiviteten havde, så den passer til risici, der giver forretningen lille gevinst."}},"deepDive":{"en":"ISO 31000:2018 clause 6.5.2 lists avoiding the risk \"by deciding not to start or continue with the activity that gives rise to the risk\" as the first treatment option, and ISO/IEC 27005 and NIST SP 800-39 use the same concept under the name risk avoidance. It is distinct from another option in the same list, removing the risk source: uninstalling a vulnerable plugin while keeping the website removes a source, whereas shutting down the website avoids the risk. The practical test is whether the business activity itself stops or is not started; if it continues in a changed form, the treatment is usually modification rather than avoidance.\n\nIn information security, avoidance most often appears as data minimisation and decommissioning. GDPR Art. 5(1)(c) (data minimisation) and 5(1)(e) (storage limitation) push in the same direction: personal data that is never collected, or is deleted when no longer needed, cannot be breached, requested in an access request or held for ransom. Other common forms are retiring end-of-life systems rather than trying to harden them, not launching a service in a jurisdiction with incompatible legal requirements, disabling a feature class altogether (for example blocking macros in Office files from the internet instead of scanning them), and not storing payment card numbers at all so that the processing leaves the organisation's PCI DSS scope.\n\nAvoidance has costs and traps. It gives up the value of the activity, so it suits risks where the activity has low benefit or where every other option leaves residual risk above appetite. It has to be complete to work: data deleted from production but still present in backups, logs, exports, test environments or a SaaS provider's retention is not avoided, only moved out of sight, so deletion should be verified and backup retention aligned. And prohibition without an alternative often displaces the risk rather than removing it: banning a popular file-sharing or AI tool without providing an approved equivalent typically drives use into personal accounts as shadow IT, where the organisation has neither visibility nor contractual control.\n\nBecause the decision usually has business consequences beyond security, avoidance is normally decided by the owner of the activity or by the management body, informed by the risk assessment rather than dictated by it. It is the only option that brings a risk to zero, but only for that specific risk; the organisation still has to check that the replacement process, if any, does not introduce new ones.","da":"ISO 31000:2018 punkt 6.5.2 nævner som første håndteringsmulighed at undgå risikoen \"ved at beslutte ikke at starte eller fortsætte den aktivitet, der giver anledning til risikoen\", og ISO/IEC 27005 og NIST SP 800-39 bruger samme begreb under navnet risikoundgåelse. Det adskiller sig fra en anden mulighed på samme liste, at fjerne risikokilden: At afinstallere et sårbart plugin og beholde hjemmesiden fjerner en kilde, mens at lukke hjemmesiden undgår risikoen. Den praktiske test er, om selve forretningsaktiviteten stopper eller aldrig startes; fortsætter den i ændret form, er håndteringen som regel reduktion snarere end undgåelse.\n\nInden for informationssikkerhed viser undgåelse sig oftest som dataminimering og udfasning. Databeskyttelsesforordningens art. 5, stk. 1, litra c (dataminimering) og litra e (opbevaringsbegrænsning) trækker i samme retning: Personoplysninger, der aldrig indsamles eller slettes, når de ikke længere er nødvendige, kan ikke blive kompromitteret, indgå i en indsigtsanmodning eller holdes som gidsel. Andre almindelige former er at udfase systemer uden support i stedet for at forsøge at hærde dem, ikke at lancere en tjeneste i et land med uforenelige lovkrav, helt at slå en type funktionalitet fra (fx blokere makroer i Office-filer fra internettet i stedet for at scanne dem) og slet ikke at gemme betalingskortnumre, så behandlingen falder uden for organisationens PCI DSS-omfang.\n\nUndgåelse har omkostninger og faldgruber. Man opgiver aktivitetens værdi, så den passer til risici, hvor aktiviteten giver lille gevinst, eller hvor alle andre muligheder efterlader en residual risiko over appetitten. Den skal være fuldstændig for at virke: Data, der er slettet i produktion, men stadig ligger i backup, logfiler, eksporter, testmiljøer eller i en SaaS-leverandørs opbevaring, er ikke undgået, kun flyttet ud af syne, så sletning bør verificeres og backupens opbevaringstid tilpasses. Og forbud uden alternativ flytter ofte risikoen i stedet for at fjerne den: Et forbud mod et populært værktøj til fildeling eller AI uden et godkendt alternativ driver typisk brugen over i private konti som skygge-IT, hvor organisationen hverken har overblik eller kontraktlig kontrol.\n\nFordi beslutningen som regel har forretningsmæssige konsekvenser ud over sikkerheden, træffes den normalt af ejeren af aktiviteten eller af ledelsen på grundlag af risikovurderingen, ikke dikteret af den. Det er den eneste mulighed, der bringer en risiko ned på nul, men kun for netop den risiko; organisationen skal stadig sikre sig, at en eventuel erstatningsproces ikke introducerer nye."},"edges":[{"type":"requires","to":"security/risk-assessment","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/risk-treatment","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/risk-mitigation","why":{"en":"Avoidance stops the activity; mitigation keeps it and adds controls to make it safer.","da":"Undgåelse stopper aktiviteten; reduktion beholder den og tilføjer kontroller for at gøre den sikrere."},"confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/shadow-it","why":{"en":"Banning an unsafe tool outright, instead of trying to secure it, is avoidance.","da":"At forbyde et usikkert værktøj helt, i stedet for at forsøge at sikre det, er undgåelse."},"confidence":"medium","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 5 og Ordliste (Risikohåndtering - eliminere)","tier":"course-material"},{"title":"ISO/IEC 27005:2022 (8.2 - Risk treatment options)","tier":"standard"}],"draft":true}