Reader small image

You're reading from  Certified Information Security Manager Exam Prep Guide - Second Edition

Product typeBook
Published inDec 2022
PublisherPackt
ISBN-139781804610633
Edition2nd Edition
Right arrow
Author (1)
Hemang Doshi
Hemang Doshi
author image
Hemang Doshi

Hemang Doshi has more than 15 years of experience in the field of system audit, IT risk and compliance, internal audit, risk management, information security audit, third-party risk management, and operational risk management. He has authored several books for certification such as CISA, CRISC, CISM, DISA, and enterprise risk management.
Read more about Hemang Doshi

Right arrow

Risk Treatment/Risk Response Options

The treatment of risk is one of the most important aspects of risk management. Risk treatment is also sometimes referred to as risk response

The following are the four options for responding to risk.

Risk Mitigation

  • In this approach, efforts are made to reduce the probability of risk or impact resulting from the risk event by designing appropriate controls.
  • The objective of risk mitigation is to reduce the risk to an acceptable level.

Risk Sharing/Transferring

  • In this approach, risk is shared with partners or transferred via insurance coverage, contractual agreement, or other means.

For example, natural disasters have a very low probability of occurring but have a high impact if they do. The response to such a risk should be risk transfer.

Risk Avoidance

  • In this approach, projects or activities that cause risk are avoided.
  • Risk avoidance is the last choice when no other response is adequate...
lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Certified Information Security Manager Exam Prep Guide - Second Edition
Published in: Dec 2022Publisher: PacktISBN-13: 9781804610633

Author (1)

author image
Hemang Doshi

Hemang Doshi has more than 15 years of experience in the field of system audit, IT risk and compliance, internal audit, risk management, information security audit, third-party risk management, and operational risk management. He has authored several books for certification such as CISA, CRISC, CISM, DISA, and enterprise risk management.
Read more about Hemang Doshi