Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
Four ways to respond
| Response | Meaning | IT examples |
|---|---|---|
| Mitigate (reduce) | Controls reduce likelihood or impact | MFA, patching, encryption, backups, monitoring |
| Transfer (share) | Someone else carries the financial impact | Cyber insurance; indemnities in supplier contracts |
| Avoid | Stop, or never start, the activity | Stop storing card data; retire an unsupported system |
| Accept (retain) | Knowingly live with the risk | A low-value internal wiki without MFA, documented and reviewed |
The goal is residual risk within appetite, at reasonable cost, not zero risk.
Choosing a response
Questions that guide the choice:
- Is the risk already within appetite? Then accept it and monitor.
- Is the activity’s benefit low compared with its risk? Consider avoiding it.
- Can controls reduce it cost-effectively? Mitigate.
- Can someone else carry the cost? Transfer or share it.
- Whatever remains is residual risk, accepted by the owner and documented.
Transferring risk moves the financial impact. Accountability, reputational damage and regulatory duties stay with the organisation.
Combining responses
Example. An unsupported manufacturing system can’t be patched, and replacing it takes two years. The plant isolates it on its own network segment and adds monitoring (mitigate), extends the cyber policy to cover business interruption (transfer), and the plant director formally accepts the remaining risk until replacement, reviewed every quarter (accept).
Who decides
| Role | Part in the decision |
|---|---|
| Security manager | Analyses the risk, designs options, estimates their cost and residual risk, recommends |
| Risk owner | A business manager who chooses the response and accepts what remains |
| Senior management | Decides when the risk is beyond the owner’s authority or the appetite |
| Risk register | Records the decision, owner, actions, dates and review |
The security manager’s job is to make sure the decision is informed, not to make it for the business.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Buying cyber insurance is an example of… | Risk transfer |
| Who decides the treatment? | The risk owner |
| Goal of risk treatment | Residual risk within appetite, cost-effectively |
| Stopping a risky activity | Avoidance |
| Does outsourcing transfer accountability? | No |
In short
- The four responses: mitigate (reduce), transfer (share), avoid (stop the activity) and accept (knowingly retain).
- The goal is residual risk within appetite at reasonable cost, not zero risk.
- Responses are often combined: mitigate, then insure what's left, then accept the remainder.
- Transferring risk moves financial impact, not accountability, reputational damage or regulatory duty.
- The security manager recommends options with costs and residual risk; the risk owner decides.
- Every treatment decision is recorded in the risk register with an owner and review date.
Exam traps
- Insurance doesn't transfer accountability or reputational damage.
- Ignoring a risk isn't acceptance; acceptance is informed, documented and approved.
- The security manager doesn't accept business risk on the owner's behalf.
- Avoidance removes the risk but also the benefit of the activity.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Four ways to respond
Choosing a response
1 / 9