Stop or change the activity so the risk goes away.
Example: Move sensitive data to a managed, secure service.
Reduce
Lower likelihood or impact
Add or improve controls to lower likelihood and/or impact.
Example: Enable MFA. Apply outstanding patches. Encrypt data at rest and in transit.
Transfer
Share the exposure
Shift part of the exposure to a third party.
Example: Cyber insurance; cloud provider with SLA guarantees.
Accept
Formal sign-off required
Formally accept the risk. Needs documented sign-off from a named owner.
Example: A low risk below threshold, accepted with a named owner.