The risk assessment conducted during the strategy phase produces a structured and prioritised understanding of the threats facing the organisation, the vulnerabilities those threats could exploit, and the potential consequences of successful exploitation. The security program’s responsibility is to translate that understanding into a deliberate and governed set of responses that reduce the organisation’s risk exposure to within its defined risk appetite. Identifying risks is a strategic activity. Addressing them is an operational one, and the quality of the program’s risk response is determined not by the sophistication of the risk assessment that preceded it but by the discipline, governance, and measurability of the response actions that follow.
Risk response is not synonymous with control implementation. Controls are one instrument of risk response, but the program must also make explicit decisions about which risks to treat, which to tolerate, which to transfer, and which to terminate, and it must do so within a governance framework that ensures those decisions are informed, accountable, and subject to ongoing review. The following framework provides the structured approach through which the security program addresses the risks identified during the strategy phase.
The Four Risk Response Strategies #
Not every identified risk warrants the same response, and not every risk is best addressed through the implementation of additional security controls. The program must apply one of four principal risk response strategies to each identified risk, selecting the strategy that is most appropriate given the nature of the risk, the cost and feasibility of available treatments, and the organisation’s defined risk appetite.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
