Risk Treatment, Response, and Mitigation

Once you have performed a risk assessment (discovered what could go wrong and how bad it would be), the next step is risk treatment. Risk treatment is the process of selecting and implementing measures to modify a risk. It is not the same as risk assessment; assessment finds the risks, treatment decides what to do about them. The CISM exam expects you to know the four primary risk treatment options: avoidance, mitigation, transfer, and acceptance.

Risk avoidance means you stop the activity that causes the risk entirely. For example, if a company decides not to launch a new online product because the security vulnerabilities are too expensive to fix, that is avoidance. The risk is gone because the activity is gone. This is the most drastic option and is usually only chosen when the cost of controlling the risk is higher than the benefit of the activity.

Risk mitigation (sometimes called risk reduction) is the most common option. You keep the activity but put controls in place to reduce either the likelihood of the risk occurring, or the impact if it does occur. A firewall that blocks malicious internet traffic is a mitigation control that reduces the likelihood of a network intrusion. A backup system that restores data if a server crashes is a mitigation control that reduces the impact of a failure. Mitigation never eliminates risk entirely; it makes it more manageable.

Risk transfer means you shift the financial burden of a risk to a third party. The most common example is cyber insurance. Your company still experiences the data breach, but the insurance company pays for the forensic investigation, legal fees, and customer notification. Transfer does not eliminate the risk itself (the breach still happens), but it moves the financial consequences. Another form of transfer is outsourcing a service to a cloud provider, where the provider contractually accepts responsibility for certain security controls.

Risk acceptance is the decision to acknowledge the risk and take no action to reduce it. This is not a lazy option; it is a deliberate, documented decision. Every organisation has a risk appetite – the amount of risk they are willing to accept. For example, a small business might accept the risk of a minor credit card theft because the cost of implementing a full payment card industry (PCI) compliance programme is greater than the potential loss. The exam emphasises that acceptance must be an explicit choice, not an oversight.

After you have treated the risk, you develop a risk response plan. This is the detailed playbook for what happens if the risk materialises into an actual incident. It includes who does what, who to call, what systems to shut down, and how to communicate with customers and regulators. The response plan is tested during drills and tabletop exercises.

A key concept for the exam is residual risk. This is the risk that remains after you apply your controls. If you install a firewall, you reduce the risk of a network attack, but a sophisticated attacker might still get through. That leftover risk is residual risk. The goal of risk treatment is to reduce residual risk to a level that is within the organisation's risk appetite.

Another critical concept is inherent risk. This is the risk before any controls are applied. If a company stores 10 million customer records with no password protection, that is a very high inherent risk. After applying encryption and access controls, the residual risk is much lower. The difference between inherent and residual risk is a measure of how effective your controls are.

The CISM exam also tests the difference between control types. Preventive controls stop a risk event from happening (e.g., a lock on a door). Detective controls identify that a risk event is happening or has happened (e.g., an alarm that sounds when the door is forced open). Corrective controls fix the problem after it has occurred (e.g., a repair crew that replaces the broken door). A complete security programme uses a mix of all three.

Finally, you must understand that risk treatment is ongoing. Risks change as the business changes, as technology evolves, and as new threats emerge. The information security manager does not do this once and then walk away. They revisit the risk register regularly, reassess controls, and adjust treatment strategies as needed.

Consider a mid-sized retail company that sells products online and in physical stores. They have just completed their annual risk assessment and identified several important risks. Let's walk through how the information security manager (ISM) handles each one.

The first risk is a potential data breach of customer credit card information from the online store. The ISM recommends a combination of risk mitigation and risk transfer. For mitigation, they implement a Web Application Firewall (WAF) to block malicious traffic and require multi-factor authentication for all administrative accounts. For transfer, they purchase a cyber insurance policy that covers up to 2 million dollars in breach response costs. The residual risk is now much lower, but it is not zero because no control is perfect.

The second risk is a fire in the main warehouse that could destroy inventory. The ISM installs smoke detectors and an automatic sprinkler system (mitigation). They also create a detailed fire response plan: the fire marshal is assigned, evacuation routes are posted, and quarterly fire drills are scheduled. This is the response plan in action. The remaining residual risk is that the sprinklers might not work if the water supply is cut off. The company decides to accept that residual risk because the cost of a backup water source is too high.

The third risk is the possibility that a key supplier might go out of business, disrupting the supply chain. The ISM cannot control whether the supplier fails, so they recommend risk transfer by contracting with a backup supplier. If the primary supplier fails, the backup supplier can fill the gap. They also recommend risk acceptance for a small amount of delay (a few days) because the backup supplier is slightly slower.

The fourth risk is that an employee might accidentally click on a phishing email and install ransomware. The ISM uses a combination of preventive controls (email filtering technology), detective controls (user awareness training and phishing simulation exercises), and corrective controls (automated backup recovery). After these controls are in place, the residual risk is reviewed by the risk committee. The risk committee approves the treatment plan and documents it in the risk register.

Now, the ISM must monitor these controls. They schedule quarterly review meetings, track control effectiveness metrics, and update the risk register when new vulnerabilities are discovered. When an actual incident occurs, the ISM leads the response team, follows the pre-defined playbook, and then conducts a post-incident review to improve controls. This iterative cycle is what the CISM exam expects you to understand in detail.