An organization may minimize or eliminate their risk by implementing security controls, retaining the risk, avoiding the risk or sharing the risk.