Risk treatment
Choose a response and verify what risk remains.
The idea
Risk treatment commonly includes reducing, avoiding, transferring or sharing, and accepting risk. Reduction applies safeguards; avoidance stops the risky activity; sharing changes who bears aspects of the consequence; acceptance records an authorized decision to tolerate remaining risk. These choices can be combined. Insurance or outsourcing does not erase responsibility or operational harm. Every treatment needs ownership, assumptions, and review of residual risk.
In practice
An organization restricts an exposed service and improves recovery, while leadership accepts a clearly described remaining outage risk until a replacement is ready.
A common misunderstanding
Buying insurance does not prevent an incident or transfer every obligation to another party.
Check your understanding
What makes risk acceptance meaningful?
Think it through: An authorized decision about a defined scenario, supported by evidence, limits, and a review date.
Choose a response to the scenario
Risk treatment can change the likelihood of an event, its consequences, or the organization's involvement in the activity. Common responses include reducing risk through controls, avoiding an activity, sharing or transferring some financial consequences, and accepting a documented residual position. These options can be combined. Buying insurance, for example, does not prevent a service outage or automatically transfer every obligation.
Select measures that address the actual scenario. If a risk concerns prolonged recovery after data corruption, stronger login controls may help prevent some causes, but recovery validation addresses a different part of the consequence. Explain how each proposed action changes the scenario rather than assuming any security purchase reduces every risk.
A fictional supplier decision
An academy wants to use a new file-sharing supplier for sensitive records. It could reduce the shared data, require stronger access arrangements, choose another supplier, or decide that the activity should not proceed. The preferred response depends on the business need, supplier capability, contractual position, and remaining exposure.
After implementation, verify that the measure operates as intended. A contract clause is evidence of an agreed obligation, while a tested access configuration or recovery demonstration provides evidence about operation. Neither should be mistaken for complete proof of future performance. Record who accepts what remains and when that decision will be reviewed.
Explain the causal link
Write a fictional scenario in which a former employee retains access to a service. Propose one preventive measure, one detective measure, and one response measure. Explain how each changes a different part of the scenario. Then identify what uncertainty remains. This prevents a treatment plan from becoming a shopping list with no clear relationship to the risk it is supposed to manage.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Guide for Conducting Risk Assessments