Treatment Strategies: Mitigate, Transfer, Accept, Avoid
The four possible responses to a risk
Faced with an identified risk, an organization has only four possible strategic responses: mitigate it by implementing controls that reduce its likelihood or impact, transfer it through cyber insurance or a contract that shifts responsibility to a third party, formally accept it when its level is within the defined risk appetite, or avoid it by eliminating the activity or system that creates it. Choosing the right strategy doesn't depend only on the severity of the risk, but also on the cost of treating it versus the cost of leaving it as is, and on whether there's even a technically viable way to reduce it. In practice, risk acceptance is often misunderstood as doing nothing, when in reality it requires a formal, documented decision approved by someone with sufficient authority, since accepting a risk without that formal backing exposes the organization to a situation where, after an incident, it's unclear who decided to tolerate it and on what grounds.