Risk-Management Strategies

AP Cybersecurity · Securing Spaces

Strategies for Managing Risk

Avoid, transfer, mitigate, accept — and write down what you accepted.

key ideaAvoid, transfer, mitigate, accept. What is left after the first three is residual risk — and it is accepted deliberately.

The stages

Once a risk is assessed, an organization has exactly four options. They are not alternatives to choose between so much as a sequence: each one reduces what the next has to handle, and acceptance is what remains.

Avoid the risk

Stop the activity generating it. Powerful, but unavailable when the activity is central to the mission — a hospital cannot stop keeping patient records.

in an assessed risk out risk removed, or not an option

Transfer the risk

Place the burden on another entity — an insurer, a government, or consumers. Note that transfer moves the financial consequence; it does not stop the attack happening.

out the loss borne elsewhere

Mitigate the risk

Implement security controls that reduce the likelihood, the impact, or both. This is where most of the work happens and where most of the budget goes.

out a smaller risk

Accept what remains

Residual risk is what survives avoidance, transference and mitigation. Accepting it is a deliberate, documented decision — it acknowledges that absolute security is unattainable.

out a signed-off risk position

Reading left to right, each option handles what the previous could not. Acceptance is not failure — it is the recognition that some risk always remains, made explicit rather than ignored.

Strategy	What changes	Example	Limit
avoid	the activity stops	stop storing card numbers; use a processor	impossible for core activities
transfer	who bears the loss	cyber-insurance; passing costs to consumers	the attack still happens
mitigate	likelihood or impact	MFA, backups, segmentation, locks	costs money and effort
accept	nothing — it is acknowledged	a low-severity risk left in place	must be documented and revisited

Note what transference does not do: an insured organization is still breached, still offline, and still explaining itself. It has moved the invoice, not the incident.

Applying it

Organizations favor solutions that are cost effective and easy to implement and maintain. Cost effective has a precise meaning here: the control costs less to install and maintain than the expected loss it prevents.

Situation	Best-fit strategy	Reasoning
a rarely used service with a serious flaw	avoid — turn it off	nothing depends on it
catastrophic but unlikely loss	transfer — insure it	cheaper than engineering it away
frequent, moderate, fixable	mitigate — add the control	clear cost-benefit case
low severity, expensive to fix	accept and document	the fix costs more than the expected loss
core business activity with real risk	mitigate + accept	avoidance is not available

The last row is the common case. Most real decisions are mitigate as far as is cost effective, then accept the remainder — with the remainder written down.

Worked analysis

EX 1

Choose a strategy with numbers

A risk has an expected annual loss of $8,000. A control that removes it costs $30,000 a year. Insurance covering it costs $5,000 a year. Advise.

Test avoidance

The activity is core, so avoidance is not available.

Test mitigation on cost

$30,000 to prevent $8,000 of expected loss is not cost effective.

Test transference

$5,000 to move an $8,000 exposure is cost effective.

Consider what remains

Insurance does not prevent downtime or reputational harm — some residual risk persists.

Recommend

Transfer the financial risk, accept and document the operational residue, and revisit if either number changes.

EX 2

When avoidance is the right answer

A legacy reporting tool is used twice a year, cannot be patched, and is reachable from the internet. What should be done?

Assess dependence

Twice a year — not central to the mission.

Assess mitigation

Unpatchable, so controls can only wrap it, never fix it.

Assess transference

Insurance would pay after a breach — it prevents nothing.

Choose

Avoid: decommission it, or take it off the internet and run it offline when needed.

State the principle

Avoidance is the strongest option and the least often available. When it is available, take it.

EX 3

Acceptance done properly

A team decides to accept a low-severity risk. What distinguishes a proper acceptance from simply ignoring it?

Require the assessment

Acceptance follows a completed assessment — you cannot accept what you never measured.

Require the alternatives

Show why avoid, transfer and mitigate were rejected.

Require an owner

A named person accepts the residual risk on the organization's behalf.

Require a review date

Conditions change; today's acceptable risk may not be next year's.

State the difference

Acceptance is documented and owned. Ignoring is neither — and only one of them survives an audit.

Check yourself

Name the four risk management options in order.

Show answer

Avoid, transfer, mitigate, accept — and what remains after the first three is the residual risk that gets accepted.

When is avoidance not available?

Show answer

When the activity generating the risk is a critical part of the organization’s mission or purpose. You cannot stop doing the thing you exist to do.

What does risk transference actually move?

Show answer

The burden of the loss — to an insurer, a government, or consumers. The attack itself is unaffected, as are downtime and reputational harm.

What makes a control cost effective?

Show answer

It costs less to install and maintain than the expected loss from the attack it prevents. Organizations also favor controls that are easy to implement and maintain.

Course map. Topic 2.1.e · LO 2.1.E — identify strategies for managing risk (EK 2.1.E.1–2.1.E.6: the four options; avoidance and its limits; transference to another entity; mitigation through security controls; residual risk and acceptance; favoring cost-effective solutions that are easy to implement and maintain).