Once a risk has been assessed and compared with appetite, the owner chooses how to respond. There are four classic options: mitigate, transfer, avoid and accept. CISM expects you to recognize them from scenarios, to know who chooses among them, and to understand that treatment is a business decision informed by security advice, not a technical decision made by the security team.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.