The second part of risk management is doing something about the risks identified. Generally, we can do a number of things about risks:
• Some risks can just be accepted and provision made in case the worst happens. If we cannot insure our data centre because it sits in a flood plain, we may
decide to hold a contingency fund in case it does flood.
• We can avoid or eliminate the risk; for example, we can eliminate the risk
to our data centre by deciding to go back to manual processing. This is not always a practical solution.
• We can transfer the risk to somebody else, for example by taking out insurance or by outsourcing the data centre and disaster recovery.
• We can reduce the risk by reducing the probability of the threat or by reducing the severity if the risk materialises. For our data centre we might move it to the top of a hill to reduce the probability of a flood or reduce the impact of a flood by replacing under floor cables with fibre optics.