The core issue is a legal and compliance risk. Storing data in a jurisdiction with weaker privacy laws directly creates a risk of violating data protection regulations (like GDPR) that mandate where and how certain data can be stored and processed. This is a fundamental IT risk consideration that outweighs technical or cost concerns in this scenario.

The immediate priority during a live ransomware attack is containment to prevent further damage. Without clear, pre-defined containment steps (like isolating networks, taking systems offline), the attack can propagate, leading to greater business impact, data loss, and recovery time. This gap represents a critical operational risk.

Inherent risk is the risk level before considering the effect of controls. The sensitivity of the data is a key intrinsic factor—if the application handles highly confidential or regulated data (e.g., PII, financial records), a vulnerability in that application inherently poses a much greater risk than if it handled public data. The other options relate to controls or mitigating factors.

The direct and primary issue is the failure to adhere to an established internal control (the encryption policy). This creates a compliance risk, as the organization is not operating in accordance with its own mandated rules designed to mitigate risk. While a data breach from an unencrypted laptop could lead to financial or reputational damage, the root cause is the compliance failure.

This tests the understanding of risk governance and tolerance. The business objective (speed to market) is valid, but it cannot unilaterally decide to bypass risk management processes. The correct approach is to formally assess the risk, determine if it exceeds the organization’s risk appetite, and have the appropriate governance body (e.g., a risk committee) make a conscious, informed decision to accept the risk or mandate controls.

For a high-probability, high-impact risk that threatens core operations, mitigation (reducing the risk to an acceptable level) is the most appropriate and practical response. Implementing redundancy directly addresses the single point of failure. Acceptance is for low-priority risks, transfer (insurance) doesn’t prevent the outage, and avoidance is often not feasible for critical business services.

The described changes—turnover in support staff and outdated audit reports—directly point to a decline in the vendor’s operational stability and security posture. This increases the organization’s operational risk, as it may face longer resolution times, more errors, and a higher likelihood of a security incident originating from the vendor’s environment.

A risk register is a fundamental governance tool. Its core purpose is to provide a living document that logs identified risks, their assessment (likelihood, impact), assigned owners, chosen responses (mitigate, accept, etc.), and status. This enables consistent oversight, communication, and decision-making regarding the organization’s risk portfolio.

This requires a practical risk-based analysis. Each option carries distinct risks: in-house development risks missing deadlines (schedule/operational risk), while outsourcing risks confidentiality breaches of IP (security/compliance risk). A sound decision requires comparing and weighing these two different risk profiles against business priorities, not applying absolute rules.

The core issue is a legal and compliance risk. Storing data in a jurisdiction with weaker privacy laws directly creates a risk of violating data protection regulations (like GDPR) that mandate where and how certain data can be stored and processed. This is a fundamental IT risk consideration that outweighs technical or cost concerns in this scenario.0