Overview
Once a risk is identified and assessed, you must decide what to do about it. Risk treatment is that decision. There are four standard options, and choosing among them — deliberately and with the right approval — is the core output of risk management.
Learning objectives
- Name the four risk-treatment options.
- Choose an appropriate treatment for a given risk.
- Understand residual risk and risk acceptance.
Core concept
The four classic treatment options (ISO 27005 / common practice):
- Mitigate (reduce) — apply controls to lower likelihood and/or impact. The most common option (patching, MFA, encryption, backups).
- Transfer (share) — shift some of the risk to another party, e.g. cyber insurance or outsourcing to a provider with stronger controls. Note: you can transfer financial loss, but usually not reputational or legal responsibility.
- Avoid — stop doing the risky activity entirely (e.g. don't collect data you don't need; retire a dangerous legacy system).
- Accept — knowingly tolerate the risk, typically when treatment costs more than the risk itself. Acceptance must be documented and approved by someone with the authority to own that risk.
How it works
After treatment, some risk almost always remains — the residual risk. Management must formally accept the residual risk or apply further treatment. This is why "accept" is not a cop-out: every risk that is mitigated still leaves a residual that someone must consciously accept.
The right choice depends on the risk level versus the cost and feasibility of each option, always weighed against the organization's risk appetite.
Practical example
For the risk "account takeover via stolen passwords":
- Mitigate: enforce MFA and monitor logins (chosen — cheap, high effect).
- Transfer: buy cyber insurance to cover breach costs (complementary, not a substitute).
- Avoid: stop offering the online account feature (usually unacceptable to the business).
- Accept: tolerate the risk as-is (unwise here given cheap mitigation exists).
A sensible plan mitigates with MFA, may transfer some financial exposure via insurance, and formally accepts the small residual risk that remains.
Cybersecurity relevance
Risk treatment turns assessment into action and budget. Every control you will study later is, in risk terms, a mitigation chosen because the risk exceeded appetite and the control was worth its cost.
Common mistakes
- Defaulting to "mitigate everything" even when avoidance or acceptance is wiser and cheaper.
- Thinking transfer removes responsibility — insurance rarely restores reputation or removes legal duty.
- Accepting risk informally, with no documentation or accountable owner.
Key takeaways
- The four treatments are mitigate, transfer, avoid, and accept.
- Every mitigated risk leaves residual risk that must be consciously accepted.
- Choose treatment by weighing risk level against cost, feasibility, and risk appetite.
Check your understanding
- For a risk you could fix cheaply, which treatment is usually best, and why?
- What is residual risk, and who should sign off on accepting it?