Risk Response
A risk response is an informed choice and the actions used to address an identified risk. NIST describes acceptance, avoidance, mitigation, sharing, and transfer. Responses can combine prevention, limits on harm, and recovery of lost capability; selecting an action does not establish that its intended effect has already been achieved.
Five responses, and what each actually requires
| Response | What it means | What it requires | Common misreading |
|---|---|---|---|
| Accept | Carry specified residual exposure under an authorized decision | A valid mandate, evidence, scope and conditions, review date, and any expiry | Continued exposure alone does not prove acceptance |
| Avoid | Stop the activity that creates the risk | A decision to forgo whatever the activity provided | That it is free. Avoiding a risk usually means giving up a benefit, which should be stated |
| Mitigate | Reduce likelihood or impact with controls | A planned course of action, tracked implementation, and evidence before crediting achieved reduction | Existing controls may already reduce exposure; a future control adds no demonstrated reduction yet |
| Share | Allocate specified consequences or responsibilities among parties | An arrangement defining each party’s duties, exposure, and ability to perform | Sharing financial loss alone does not restore interrupted service |
| Transfer | Assign specified consequences or responsibilities to another party | Applicable terms, coverage, exclusions, and credible performance | Some duties and customer impacts can remain with the organization |
For example, insurance can cover some financial consequences of an outage while customers still lack service. A provider contract may assign operational duties and liability, but its actual terms and applicable obligations determine what moves and what remains. If the provider’s controls lower likelihood or impact, record that as mitigation as well. Transfer does not by itself establish that the organization can continue meeting its commitments.
Separate the plan from the current exposure
Record the current residual estimate using operating controls and verified completed stages, then record the projected estimate after additional work separately. Link the plan, resources, milestones, and any acceptance to the same risk ID in the risk register. If acceptance is pending or absent, say so and define interim restrictions or other responses; do not relabel the exposure as approved. A missed milestone triggers reassessment of the estimate and approval conditions. A June milestone moving to July need not extend an approval valid through December, unless its conditions make that milestone binding. A change outside the authorized scope or period requires the appropriate approval before continued reliance on it; an expired approval without renewal leaves unapproved exposure.
Choosing among them
Compare options using cost, residual exposure, and reversibility. What does each option cost, including the benefit forgone by avoidance? What residual risk remains after it, and is that within the limits the organization has set, as described in risk appetite? And how reversible is the choice — an accepted risk can be revisited next quarter, an avoided product line usually cannot be restarted cheaply.
Real responses are usually combinations. A single-region deployment might be mitigated with tested backups, have its financial impact partly transferred by contract terms, and have the remaining exposure accepted for a year while a second region is funded. Recording each part separately keeps the register truthful about which part is carrying the weight. What makes a control count as operating is covered in risk control, the security view of the same question in security control, and what remains afterward in residual risk.
How responses, acceptance authority, owners, and review fit together for technology risk is worked through in Amber for Three Years.
References
- NIST Computer Security Resource Center Glossary, risk response
- NIST IR 8286 Rev. 1 — Integrating Cybersecurity and Enterprise Risk Management (2025)
- NIST SP 800-39 — Managing Information Security Risk (2011)
Discover more from Insightful Data Lab
Subscribe to get the latest posts sent to your email.