Purpose: Treatment is the management decision about what to do with identified exposure. The options can be combined and should be documented with owners, timing, cost, and remaining risk.
Treatment choices
ReduceChange likelihood or consequence through safeguards, redesign, process change, testing, or additional recovery capability.
AcceptCarry the residual exposure knowingly for a defined period and with appropriate authority.
TransferShift part of the financial or contractual consequence through insurance, contract, outsourcing, or indemnity, while recognizing that not all effects transfer.
AvoidStop, delay, redesign, or decline the activity creating the exposure.
MonitorWatch defined signals while preserving a decision point; monitoring is not a substitute for treatment when exposure is already unacceptable.
Worked examples
| Example | Context / Rating | Condition / Safeguard |
|---|
How to use this page
- Confirm the risk statement and residual assessment.
- Compare treatment cost, timing, feasibility, and effect.
- Identify secondary risks created by the treatment.
- Assign approval authority and action ownership.
- Reassess residual risk after treatment is implemented.
Cautions
- Buying a tool is not a complete treatment plan.
- Transfer rarely removes operational, customer, or reputational consequence.
- Monitoring alone is weak when no threshold or decision trigger exists.
Educational use: Tailor the language and decision authority to the organization. This page is not a certification, legal opinion, security assessment or substitute for professional advice.
Frequently asked questions
Can a small organization use this tool?
Yes. Reduce the number of fields or questions, but retain the scenario, business consequence, accountable owner, decision and review date.
Does this replace professional advice?
No. It is an educational structure. Legal, insurance, compliance, cybersecurity and other professional decisions may require qualified advice.
How often should it be updated?
Update it when the related service, supplier, data, threat conditions, controls, incident history or business priorities change materially.