Risk evaluation, risk treatment and risk acceptance
Domain 6 - Risk evaluation, risk treatment and risk acceptance
This domain tests the decision logic: compare analysed risk with criteria, choose treatment, reassess residual risk and obtain authorised acceptance.
Core rules
- Evaluation compares risk levels with criteria to decide which risks need treatment and their priority.
- Treatment options include avoid, modify (change likelihood or consequence), share (insurance or contract) and retain. ISO 31000 also describes pursuing risk and removing the risk source.
- A risk treatment plan states selected controls, responsibilities, resources, timelines and expected performance; controls may come from ISO/IEC 27001 Annex A or elsewhere.
- Residual risk is evaluated after treatment. If it remains above tolerance, further treatment or avoidance is required.
- Acceptance is an informed decision by a risk owner with authority, recorded with rationale and reviewed periodically. Insurance shares financial consequence but does not transfer accountability.
Worked example
A legacy ordering application cannot be patched. Evaluation rates the risk high. Treatment combines network segmentation and enhanced monitoring (modify likelihood), cyber insurance (share financial consequence) and a 12-month migration plan. Residual risk is medium, still above the low tolerance for payment data. The CIO, as risk owner, accepts it for 12 months with quarterly review. Reasoning: the acceptance is time-bound, authorised and conditional; the residual risk, not the original score, drives the decision.
Traps
Accepting risk without authority; treating every risk as requiring a new control; omitting residual-risk evaluation; assuming insurance removes accountability; writing a SoA without linking controls to risks; letting a risk acceptance live indefinitely.