According to the Operational Risk: Overview, Importance, and Examples article, operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems. One of the factors that can increase operational risk is the complexity of IT infrastructure, which refers to the number, variety, and interdependence of IT components, such as hardware, software, networks, and data. A complex IT infrastructure can pose challenges for IT management, such as increased costs, reduced performance, lower reliability, higher vulnerability, and more difficulty in troubleshooting and maintenance. Therefore, minimizing the complexity of IT infrastructure can help reduce IT operational risk, as it can simplify IT operations, improve IT efficiency and effectiveness, enhance IT security and resilience, and facilitate IT innovation and adaptation. References = Operational Risk: Overview, Importance, and Examples

Monitoring the number of incidents with downtime exceeding the contract threshold is a critical KRI for assessing the effectiveness of infrastructure upgrades aimed at enhancing service availability. This metric directly reflects the provider's ability to meet agreed-upon service levels and helps identify areas requiring further improvement.
Reference:ISACA CRISC Review Manual, 7th Edition, Chapter 4: Information Technology and Security, Section: Key Risk Indicators.

The best way to ensure data is properly sanitized while in cloud storage is to cryptographically scramble the data. Cryptographic scrambling is the process of transforming data into an unreadable form using a secret key or algorithm. Cryptographic scrambling protects the data from unauthorized access, modification, or deletion, even if the cloud storage provider or a third party gains access to the data. Cryptographic scrambling also ensures that the data can be restored to its original form using the same key or algorithm, if needed. The other options are not as effective as cryptographic scrambling, because they either do not completely remove the data, or they make it impossible to recover the data. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.1, page 3-21.

Comprehensive and Detailed Explanation From Exact Extract:
Even if the residual risks are low, an ineffective key control warrants proposing additional mitigating controls to strengthen risk management. Accepting the risks without controls may expose the enterprise to unnecessary vulnerabilities. Targeted assessments may follow but addressing control weaknesses is the immediate priority.
Risk tolerance is relevant but secondary in this context.

Using a VPN ensures the secure transmission of sensitive data over a public network by encrypting the communication channel. This mitigates risks such as interception or unauthorized access, aligning withData Protection and Privacy Standards.