Due to technical and operational constraints, the preferred control to lower the risks identified is...

Outsourcing IT operations to an external vendor is a form ofrisk transfer(C), where the responsibility for managing certain risks (e.g., operational or technical risks) is shifted to the vendor. According toISO 31000, risk treatment strategies include transferring risk to a third party, often through contracts or outsourcing agreements, where the vendor assumes responsibility for mitigating specific risks.

Sharing (A):Involves distributing risk among multiple parties, not fully transferring it to one.

Retention (B):Means accepting the risk without mitigation, not applicable here.

Modification (D):Refers to changing processes or controls to reduce risk, not outsourcing.