Risk Treatment and Control Selection
Domain 5 tests how you choose and justify risk responses. The exam expects control categories, cost-benefit reasoning, and residual-risk acceptance.
Core rules
- Treatment options are avoid, reduce, transfer or share, and accept; acceptance must be explicit and owned.
- Control types include preventive, detective, corrective, and compensating; layer them for defense in depth.
- Map each control to the risk it addresses and the threat or vulnerability path it interrupts.
- Control selection compares cost with expected risk reduction, not with the size of the risk alone.
- Frameworks such as NIST SP 800-53, CIS Controls, and ISO/IEC 27001 Annex A provide control catalogs; tailoring is still required.
Worked example
A remote-access risk has an ALE of $1.2 million. MFA costs $150,000 per year and is expected to reduce the ALE to $300,000, a $900,000 benefit and a 6:1 ratio. A full network redesign costs $2 million and reduces ALE to $200,000, a $1 million benefit but a poor first-year ratio. The team selects MFA, records residual risk of $300,000 within tolerance, and schedules the redesign as a longer-term project. The reasoning weighs risk reduction against cost and timing, not control prestige.
Traps
- Calling insurance risk elimination; transfer shares financial impact but not accountability.
- Selecting a control without linking it to a specific risk.
- Assuming a control operates effectively without testing it.
- Ignoring compensating controls when a primary control is impractical.