A financial services company has identified that ransomware attacks pose a significant threat to their operations. After conducting a risk analysis, they determine the annualized loss expectancy (ALE) is $2.4 million. The company decides to implement offline encrypted backups, endpoint detection and response (EDR) solutions, and security awareness training at a total annual cost of $480,000, which reduces the ALE to $600,000. Which risk management strategy is the company primarily employing?