CompTIA Security+ (SY0-801)
Accept, avoid, mitigate or transfer risk: Security+ explained
Accept a risk when it is within the organization's risk tolerance. Avoid it when it exceeds tolerance and no practical safeguard exists, by dropping the activity or technology that causes it. Mitigate it by adding safeguards that lower it, and transfer it by shifting liability to another party, such as an insurer.
The four responses
NIST SP 800-39 lists the ways to respond to risk as acceptance, avoidance, mitigation, sharing and transfer, or a combination of them. NIST defines risk response as accepting, avoiding, mitigating, sharing or transferring risk.
Acceptance is the right response when the risk is within the organization's risk tolerance. SP 800-39's example is a data center in a region where major earthquakes are rare: the organization accepts that an earthquake is possible but judges it not cost-effective to address.
Avoidance may be right when the risk exceeds tolerance. It means removing or changing the activity or technology behind the risk. SP 800-39's example: an organization finds a planned network connection between two domains carries unacceptable risk, safeguards are not practical, so it removes the connection and moves data manually by storage device, an air gap.
Mitigation, also called risk reduction, handles the part of the risk that cannot be accepted, avoided, shared or transferred. It can use common controls, process re-engineering, or new or enhanced management, operational or technical safeguards.
Transfer and sharing
Risk transfer shifts the entire responsibility or liability to another organization, for example through insurance. Risk sharing shifts only part of it, usually to an organization better placed to address it.
SP 800-39 states that risk transfer reduces neither the likelihood of harmful events nor the harm they cause. Insurance pays for losses. It does not stop the outage. If the goal is to reduce the harm while the system stays in service, the answer is mitigation.
Choosing between them
Read the scenario for three clues. Is the risk within tolerance? Then accept. Is it beyond tolerance with no practical safeguard, and can the activity be dropped? Then avoid. Must the activity continue with less risk? Then mitigate. Is the aim to move the financial liability elsewhere? Then transfer.
An insurance offer does not make transfer the right answer. If the risk is already within tolerance, acceptance is the appropriate response even when coverage is available.
Where the exam catches people
- Believing buying insurance reduces the risk itself: transfer moves liability but reduces neither likelihood nor harm.
- Believing an available insurance policy means you should transfer: a risk within tolerance is accepted.
- Believing avoidance means ignoring a risk: avoidance removes or changes the activity or technology that causes it.
- Believing avoidance fits when the system must stay in service: if the activity must continue, the response is mitigation.
- Believing mitigation means only technical controls: it can also be common controls, process re-engineering, or management and operational safeguards.