A risk committee has just scored ransomware on its file servers at 20 out of 25, near the top of the heat map. The analysis is finished, and now someone has to decide what to do about it. There are only four real choices: reduce the risk, shift part of it to someone else, stop doing whatever creates it, or knowingly live with it.
On the CompTIA Security+ SY0-801 exam, risk treatment sits under objective 5.2, which expects you to explain how risk management decisions shape an organization's security. This lesson covers the four treatments (mitigating, transferring, avoiding and accepting), how risk exceptions fit in, and how inherent and residual risk describe a risk before and after it's treated.
Every analyzed risk ends in one of four treatment decisions
| Treatment | What the organization does | Example |
|---|---|---|
| Mitigate | Adds or improves controls to lower likelihood or impact | Deploys phishing-resistant MFA and EDR |
| Transfer | Shifts the financial impact or the work to another party | Buys cyber insurance |
| Avoid | Stops, or never starts, the activity that creates the risk | Retires an internet-facing legacy application |
| Accept | Knowingly takes on the risk, with documented sign-off | Keeps an old lobby kiosk until its scheduled replacement |
The risk owner chooses the treatment and the security team advises. The choice depends on what the treatment costs compared with the loss it prevents, how the remaining risk compares with the organization's appetite, any legal or contractual obligations, and how much the business values the activity that creates the risk.
Treatments are often combined. A typical ransomware plan mitigates most of the risk with controls, transfers part of the remaining financial exposure to an insurer, and accepts what's left. Other frameworks use different words for the same ideas, such as reduce for mitigate, share for transfer and retain for accept, so expect those synonyms in study material.
Mitigation adds controls that lower likelihood or impact
Mitigation is the most common treatment and the one most of this course teaches. Some controls make the event less likely: patching, MFA, email filtering, least privilege and network segmentation. Others make it less damaging when it happens: immutable backups, encryption of stored data, redundancy and a rehearsed incident response plan. Good plans use both kinds.
Mitigation rarely takes a risk to zero; it moves the risk to a lower score. Two conditions decide whether it works. The control must be proportionate, meaning its cost is justified by the reduction in expected loss, which is the cost-benefit test from the previous lesson. And it must actually function. An EDR agent installed in audit-only mode, or a backup job nobody has ever restored, doesn't lower the risk the way the register claims.
On the exam, wording such as "implement," "deploy," "harden," "patch" or "reduce the likelihood" signals mitigation.
Transfer moves the financial impact, but accountability stays with the organization
Transferring a risk shifts some of its consequences to another party. The two common methods are insurance and outsourcing.
Cyber insurance pays for costs that follow an incident: forensic investigation, legal counsel, breach notification and credit monitoring, business interruption losses, liability claims and, under some policies, extortion payments. Insurers commonly require controls such as MFA, EDR and offline backups before they'll write a policy, and a claim can be reduced or denied if controls the organization attested to weren't actually in place. Insurance changes who pays. It doesn't make an attack less likely, and it doesn't shorten the outage.
Outsourcing hands an activity to a provider, such as a managed security service provider for monitoring, a SaaS vendor for payroll or a cloud provider for hosting. Contracts and service-level agreements define what the provider is responsible for, and indemnification clauses can let you recover costs if the provider causes a loss. In the cloud, the shared responsibility model splits duties between provider and customer, which the architecture models section covers.
This is the key distinction: you can transfer responsibility for doing the work, and you can transfer some of the cost, but you can't transfer accountability for the outcome. If your payroll provider leaks employees' Social Security numbers, your employees, regulators and the press will still hold you accountable. Notification duties under laws such as HIPAA and GDPR generally sit with the organization the data belongs to (the covered entity under HIPAA, the controller under GDPR), and the provider must report the breach to that organization. The contract decides who pays; it doesn't make the data stop being yours.