3.2.1. Risk Treatment Options
💡 First Principle: Every risk treatment option changes who bears the consequence or how likely it is to occur — none of them make the underlying risk disappear, they only reshape it.
| Option | What Actually Happens | Example |
|---|---|---|
| Accept | Owner formally acknowledges and monitors the exposure | Low-impact risk on a system being retired next quarter |
| Mitigate | Controls reduce likelihood and/or impact | Deploying MFA to reduce credential-theft likelihood |
| Transfer | Financial impact shifts to a third party | Cyber insurance policy, indemnification clause |
| Avoid | The risky activity itself is stopped | Discontinuing a product feature with unacceptable exposure |
Transfer is the option most often misunderstood: buying insurance moves who pays for the loss, not whether the loss — or the operational and reputational fallout of an incident — actually happens. The organization still has to respond to, contain, and recover from an incident even when insurance later reimburses part of the financial cost; the underlying operational risk was never actually removed, only its financial consequence was reshaped.
Choosing among the four is a cost-benefit decision made against the organization's risk appetite: compare each option's cost with the risk's business impact and expected loss (such as ALE from 3.1.3), and with the residual risk it leaves. Accepting can be the right call when mitigation would cost more than the loss it prevents, provided the residual exposure sits within that appetite and the accountable owner documents the decision. Avoidance's direct cost is the business value of the activity given up. The options also combine — mitigate to cut likelihood, then insure the residual; or formally accept interim exposure, with monitoring, while a longer mitigation project is built. A register where nearly every risk says "mitigate" usually means the other three were never seriously weighed.
⚠️ Exam Trap: Risk transfer via insurance is sometimes treated as eliminating the risk entirely. The correct answer recognizes transfer shifts financial impact only — the operational and reputational risk, and the obligation to respond to an incident, remain with the organization.
Reflection Question: Your organization purchases cyber insurance covering the full estimated financial cost of a ransomware incident. Has the risk been eliminated? What still has to happen operationally if that ransomware incident occurs?
