Risk Treatment.

The decision and actions taken to modify a risk, typically by accepting, mitigating, transferring, or avoiding it, based on the organization's risk criteria. It belongs to the Compliance & Frameworks category of cybersecurity.

The decision and actions taken to modify a risk, typically by accepting, mitigating, transferring, or avoiding it, based on the organization's risk criteria.

Risk treatment is the step in the risk management cycle where assessed risks are matched with a response. The classic options are: accept (live with the residual risk), mitigate (apply controls to reduce likelihood or impact), transfer (insurance, contractual clauses, outsourcing), or avoid (stop or redesign the activity). Treatment plans specify owners, costs, timelines, target residual risk, and required controls drawn from frameworks such as ISO/IEC 27001 Annex A or NIST SP 800-53. The plan is tracked in the risk register and revisited when controls fail, threats change, or business objectives evolve. Effective treatment is proportionate to the risk and aligned with risk appetite and tolerance.

Defences for Risk Treatment typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Risk response, Risk mitigation plan.