When should a company consider transferring risk instead of attempting to mitigate risks due to their IT infrastructure? What would you do, if you were a CEO facing this dilemma? What are the ethical considerations concerning the privacy of your customers?