A company runs a legacy file-sharing service that no employees have used in over a year. A security review finds the service has multiple unpatched flaws and no available vendor patches. Management decides to permanently shut down and remove the service entirely rather than continue running it. Which risk treatment approach does this decision represent?