Risk avoidance

ISO 31000:2018 clause 6.5.2 lists avoiding the risk "by deciding not to start or continue with the activity that gives rise to the risk" as the first treatment option, and ISO/IEC 27005 and NIST SP 800-39 use the same concept under the name risk avoidance. It is distinct from another option in the same list, removing the risk source: uninstalling a vulnerable plugin while keeping the website removes a source, whereas shutting down the website avoids the risk. The practical test is whether the business activity itself stops or is not started; if it continues in a changed form, the treatment is usually modification rather than avoidance.

In information security, avoidance most often appears as data minimisation and decommissioning. GDPR Art. 5(1)(c) (data minimisation) and 5(1)(e) (storage limitation) push in the same direction: personal data that is never collected, or is deleted when no longer needed, cannot be breached, requested in an access request or held for ransom. Other common forms are retiring end-of-life systems rather than trying to harden them, not launching a service in a jurisdiction with incompatible legal requirements, disabling a feature class altogether (for example blocking macros in Office files from the internet instead of scanning them), and not storing payment card numbers at all so that the processing leaves the organisation's PCI DSS scope.

Avoidance has costs and traps. It gives up the value of the activity, so it suits risks where the activity has low benefit or where every other option leaves residual risk above appetite. It has to be complete to work: data deleted from production but still present in backups, logs, exports, test environments or a SaaS provider's retention is not avoided, only moved out of sight, so deletion should be verified and backup retention aligned. And prohibition without an alternative often displaces the risk rather than removing it: banning a popular file-sharing or AI tool without providing an approved equivalent typically drives use into personal accounts as shadow IT, where the organisation has neither visibility nor contractual control.

Because the decision usually has business consequences beyond security, avoidance is normally decided by the owner of the activity or by the management body, informed by the risk assessment rather than dictated by it. It is the only option that brings a risk to zero, but only for that specific risk; the organisation still has to check that the replacement process, if any, does not introduce new ones.