Information Security Risk Management · Lesson 6 of 13
Choose a response and assign ownership
21 minutes · Content checked 2026-10-17
AI editorial review completed — introductory draft; detailed revised-exam mapping unverified. Target edition: exams from 3 November 2026. Detailed revised-syllabus alignment remains pending.
Read the coverage and AI editorial review report
Loading progress…
Completion records your selection; it does not certify understanding or exam readiness.
What you will learn
- Compare treatment options.
- Distinguish acceptance from inaction.
- Assign action owners and review remaining exposure.
Compare realistic options
Risk responses may include avoiding an activity, reducing exposure, sharing some consequences through arrangements such as insurance, or retaining an understood exposure. Evaluate feasibility, cost, time, and the remaining risk for each option. A single response may combine several measures.
For a vulnerable service, possible actions include restricting access, implementing a supported replacement, or retiring an unused function. Compare the operational consequences of each action. A temporary restriction may reduce exposure while a permanent change is prepared, but it needs an owner and a review date.
Make acceptance an explicit decision
Acceptance requires the appropriate authority, an understood exposure, and a record of the decision. The fact that a risk has remained open for months does not mean it has been accepted. Define the scope, rationale, expiry or review condition, and the party authorized to reconsider it.
Risk appetite expresses the general amount and type of exposure the organization is willing to pursue or retain. Tolerance establishes more specific boundaries for objectives or activities. Local terminology varies, so use the organization's approved definitions. Escalate decisions beyond delegated limits.
Verify the outcome
A treatment plan should name accountable owners, actions, resources, due dates, dependencies, and the evidence required for completion. After implementation, evaluate whether the response actually changed exposure. Closing a project task and closing a business risk are different decisions.
Sharing financial consequences does not transfer every obligation or operational effect. Check exclusions, dependencies, and responsibilities. Obtain qualified advice for contractual or insurance interpretation rather than treating a policy purchase as complete risk removal.
Keep treatment and remaining exposure distinct
Define the target exposure and how treatment effectiveness will be checked. If an access restriction is planned but not operating, the current assessment still reflects the existing access path. Once implemented, verify the restriction and reassess the remaining scenario rather than simply subtracting a fixed number from a risk score.
Risk acceptance may apply to the exposure remaining after treatment, within documented authority. Temporary safeguards, implementation milestones, and review triggers make that decision reviewable. Sharing a covered financial consequence does not automatically transfer accountability for handling customer information or restoring service.
Work through a scenario
A team misses a remediation deadline and asks to mark the risk accepted to keep the dashboard green. What should happen?
Compare your reasoning
Escalate the overdue action and obtain a properly authorized, documented decision about treatment or temporary acceptance. Preserve the accurate status and remaining exposure.
A reporting target cannot replace decision authority. Concealing delay prevents leadership from allocating resources or changing priorities.
Worked exercise: Compare treatment and residual exposure
Fictional facts for learning. These assumptions and thresholds apply only to this exercise. Try the tasks before opening the worked solution.
- Exposure
- A legacy export service can disclose customer records if its shared account is misused.
- Options
- Retire exports immediately; restrict exports to an approved team while replacing the service; continue unchanged.
- Constraint
- The business currently uses exports for a time-critical reconciliation process.
Your task
- Compare the operational tradeoffs.
- Describe a treatment record and the remaining risk decision.
Show worked solution
- Immediate retirement reduces the export path but may disrupt reconciliation. Restriction can reduce exposure while preserving some capability, but shared-account misuse and manual handling may remain. Continuing unchanged retains the current exposure.
- Record the authorized risk owner, interim access controls, replacement owner, due date, resource needs, evidence of implementation, and review trigger. Confirm whether the interim exposure is within approved limits and escalate if it is not.
- After replacement, verify permissions, data handling, and retirement of the old path. A completed installation task is not proof that residual exposure is acceptable. No option can be declared best without the missing impact and effectiveness evidence.
This exercise is not scored and does not contribute to an exam-readiness result.
Applied study · Added 2026-10-22
Distinguish transfer, mitigation and residual acceptance
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: Treatment changes risk; acceptance assigns a decision.
Explore the anchors
Stop or redesign the risky activity.
Concept matching activity
Match this task or description to its concept:
Change exposure or contractual allocation.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 2B1. Open its full syllabus chapter.
Evaluate what the treatment actually changes
Mitigation reduces a scenario’s likelihood or consequence through controls. Transfer allocates some financial or contractual consequences but does not automatically transfer legal duties, customer trust or operational responsibility. Avoidance removes the activity creating the exposure, while acceptance is an authorized decision to retain it. A response can combine these approaches. Record what remains after treatment and who can accept that residual exposure.
Track the conditions behind acceptance
Approval should specify scope, assumptions, safeguards, owner, duration and reassessment triggers. Acceptance based on a planned control is not the same as acceptance after its effectiveness has been verified. Supplier contracts and insurance policies require review of exclusions, notification requirements and practical recovery capability. Security managers should present these limits clearly rather than describing a purchased policy as a complete operational response.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A supplier contract provides compensation for an outage.
- The customer still has no manual workaround, and an outage could prevent its critical daily service.
Your task
- Classify the contractual response.
- Identify the remaining treatment decision.
Compare with the model answer
Compensation transfers some financial consequence but does not restore the customer’s service. Assess recovery, alternate processing and dependency controls, then present residual service risk to the authorized business owner. Review contract limitations and do not claim that the supplier accepted all of the customer’s obligations.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Key terms
- Risk acceptance
- An authorized decision to retain a defined exposure.
- Treatment plan
- An owned set of actions intended to change a risk.
Remember
- Compare options and residual exposure.
- Document acceptance authority.
- Verify benefit before closing the risk.
Check your understanding
Does insurance eliminate the risk of a service outage?
Show explanation
No. It may share covered financial consequences while service interruption, exclusions, and other responsibilities remain.
Further reading
- NIST SP 800-30 Rev. 1 — risk assessment guidance
- NIST SP 800-39 — risk response and organizational accountability
Examples and explanations are original learning material. These links provide background guidance; they do not certify exam coverage.
Found something unclear or inaccurate? Report a content correction.