thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Risk Treatment

Selecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.

Definition

Risk treatment (also called risk response) chooses among reducing risk with controls, sharing or transferring it (insurance, outsourcing contracts), avoiding it by stopping the activity, or accepting it. ISO/IEC 27001 requires a risk treatment plan and a Statement of Applicability documenting control choices. Treatment decisions belong to the risk owner and should consider cost versus benefit.

Example

Management buys cyber insurance (transfer) and deploys EDR (mitigate) for the ransomware risk.

Exam tip

Transfer shifts financial impact but not accountability; the organization still owns the risk.

Related terms