Risk treatment: accept, avoid, transfer, mitigate

After risks are identified and analyzed, the organization must decide what to do about each one. This decision is called risk treatment or risk response, and Security+ lists four main strategies: accept, avoid, transfer and mitigate. No organization can eliminate all risk, so the goal is to bring each risk within the organization's risk appetite at a sensible cost. Exam questions usually describe an action and ask which strategy it represents, so focus on recognizing each strategy from a scenario.