Security Program Management and Oversight · Topic 3 of 7
Risk Strategies and Business Impact Analysis
Security+ risk responses of mitigate, transfer, accept and avoid, risk reporting, and business impact analysis with RTO, RPO, MTTR and MTBF.
- 4 min
- The four responses are mitigate, transfer, accept and avoid.
- Transfer moves financial impact, such as through insurance, but not accountability.
- Accepting a risk should be documented and approved, often as an exception or exemption.
What it is
Once a risk is measured, management chooses how to respond. The four standard responses are transfer, accept, avoid and mitigate.
A business impact analysis (BIA) supports those choices by showing which business functions matter most and how fast they must return after a disruption.
How it works
Risk management strategies
| Strategy | Meaning | Example |
|---|---|---|
| Mitigate | Reduce the likelihood or impact with controls | Patch the system, add a firewall |
| Transfer | Move the financial impact to another party | Buy cyber insurance, outsource to a provider |
| Accept | Decide to live with the risk | Document and approve a low risk |
| Avoid | Stop the activity that causes the risk | Do not launch a risky product, shut down a service |
Transfer moves the cost, not the responsibility. If a provider is breached, the organization still answers to its customers and regulators.
Acceptance in detail
Acceptance should be a conscious, documented decision by someone with authority, not a default. The two forms in the objective are exceptions and exemptions.
| Form | Meaning |
|---|---|
| Exception | Permission to depart from a rule for a stated reason and time |
| Exemption | A release from a requirement altogether |
Acceptance usually comes with a review date and sometimes compensating controls.
Risk reporting
Risk reports give management a view of risk across the organization. They include the top risks, trends, key risk indicators, and the status of treatment plans. Clear reporting lets leaders compare the risk to the stated appetite and decide whether more money or effort is needed.
Business impact analysis
A BIA identifies critical functions and the effect if each one stops. It guides recovery priorities and the choice of continuity measures.
| Term | Meaning |
|---|---|
| Recovery time objective (RTO) | The longest acceptable time to restore a function after disruption |
| Recovery point objective (RPO) | The longest acceptable amount of data loss, measured in time |
| Mean time to repair (MTTR) | The average time needed to repair a failed component or system |
| Mean time between failures (MTBF) | The average time a repairable system operates between failures |
RTO and RPO are targets that the business sets. MTTR and MTBF are measurements of how a system behaves, and they help show whether the targets can be met.
Using the BIA
A function with a very short RTO needs high availability, such as a hot site or redundancy. A function with a long RTO can use cheaper methods, such as restoring from backup. The BIA also finds dependencies, for example a payroll system that relies on a database and a network link, and these must be recovered first.
Choosing a response
Compare the cost of the control with the risk. If mitigation costs more than the loss, acceptance or transfer may be the better choice. If a risk is too high and cannot be reduced enough, avoidance may be right.
What to remember for the exam
- The four responses are mitigate, transfer, accept and avoid.
- Transfer moves financial impact, such as through insurance, but not accountability.
- Accepting a risk should be documented and approved, often as an exception or exemption.
- Avoid means stopping the risky activity.
- A BIA identifies critical functions and sets recovery priorities.
- RTO is about time to restore. RPO is about the amount of data loss allowed.
- MTTR is average repair time, and MTBF is average time between failures.
- Risk reports compare current risk with the organization's appetite.
If a scenario says a company buys insurance or outsources a risky process, the strategy is transfer.
Common mistakes
Thinking transfer removes the duty. The organization still owns the consequences with customers and regulators.
Accepting a risk without documentation. Informal acceptance leaves no record of who decided or why.
Mixing RTO and MTTR. RTO is a target set by the business. MTTR is a measured average of actual repair time.
Confusing MTBF with MTTR. MTBF measures how long a system runs between failures, and MTTR measures how long a repair takes.
Treating avoidance as the default. Avoiding the activity can also mean losing the business benefit.
A BIA that ignores dependencies gives false recovery targets. Include every system, supplier and person the function relies on.
Check yourself
Which risk strategy is buying cyber insurance?
Transfer, because it moves the financial impact to the insurer.
What does RPO describe?
The maximum acceptable amount of data loss, measured as a period of time.
What is the difference between MTBF and MTTR?
MTBF is the average time between failures, while MTTR is the average time taken to repair a failure.
Topic 3 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.