Security Program Management and Oversight · Topic 3 of 7
Risk Treatment and Business Impact
Security+ risk treatment: transfer, accept, avoid and mitigate, plus BIA, risk appetite, residual risk and the SLE, ARO and ALE formulas, with examples.
- 5 min
- The four treatments are transferring, accepting, avoiding and mitigating.
- Transfer moves financial impact but not accountability.
- Acceptance must be documented and approved by someone with authority.
What it is
Once a risk is measured, management chooses how to treat it. The four standard treatments are transferring, accepting, avoiding and mitigating.
Those choices are business decisions. They depend on what the organization is willing to risk, what the law requires, how much a loss would cost and which functions matter most.
How it works
Risk treatment
| Treatment | Meaning | Example |
|---|---|---|
| Transferring | Move the financial impact to another party | Buy cyber insurance, outsource a process |
| Accepting | Decide to live with the risk, with a documented approval | Keep a low risk legacy system for six more months |
| Avoiding | Stop the activity that causes the risk | Cancel a risky product launch, shut down a service |
| Mitigating | Reduce the likelihood or impact with controls | Patch the system, add multifactor authentication |
Transfer moves the cost, not the accountability. If a provider is breached, the organization still answers to its customers and regulators.
Acceptance should be a conscious decision by someone with authority, recorded in the risk register with a review date. It is not the same as ignoring a risk.
Business impact analysis
A business impact analysis (BIA) identifies the critical business functions and the effect on the organization if each one stops. It shows which functions must be restored first and sets recovery targets, such as how long a function may be down and how much data may be lost.
The BIA also finds dependencies. A payroll system that relies on a database and a network link cannot be restored until those are working.
Business-level considerations
| Consideration | Meaning |
|---|---|
| Risk appetite | The amount and type of risk the organization is willing to take to reach its goals |
| Residual risk | The risk that remains after treatment, which must fall within the appetite |
| Stakeholder involvement | Bringing in business owners, legal, finance and IT so decisions reflect real impact |
| Management oversight | Senior leaders review the risk picture, approve treatments and accept residual risk |
| Regulatory | Rules from regulators that may require certain controls or forbid accepting some risks |
| Legal | Laws and contracts that create liability, such as breach notification duties |
Regulatory and legal factors can override appetite. A company may be willing to accept a risk, but if a regulation requires a control, it must mitigate.
The loss formulas
Quantitative analysis puts money values on risk. Two inputs come first: the asset value (AV) and the exposure factor (EF), which is the percentage of the asset's value lost in one event.
| Term | Meaning | Formula |
|---|---|---|
| Single loss expectancy (SLE) | Expected loss from one event | SLE = AV x EF |
| Annualized rate of occurrence (ARO) | How many times per year the event is expected | Estimated, can be a fraction |
| Annualized loss expectancy (ALE) | Expected loss per year | ALE = SLE x ARO |
Worked example. A server is worth 200,000 and a failure would destroy 25 percent of its value, so the SLE is 50,000. If the failure is expected once every two years, the ARO is 0.5, and the ALE is 25,000.
A control is worth buying if its yearly cost is less than the loss it prevents. If a control costs 10,000 a year and cuts the ALE from 25,000 to 5,000, it saves 20,000, which is more than its cost.
Choosing a treatment
Compare the cost of the control with the reduction in loss. If mitigation costs more than the loss, acceptance or transfer may be better. If a risk is too high and cannot be reduced enough, avoidance may be right.
How the exam asks about this
- "The company buys a cyber insurance policy to cover ransomware losses." -> Transferring.
- "A flood is expected once every 20 years and would cause 400,000 of damage." -> ARO is 0.05, so ALE is 20,000.
- "After new controls, a small risk remains and the CISO signs off on it." -> Residual risk accepted under management oversight.
What to remember for the exam
- The four treatments are transferring, accepting, avoiding and mitigating.
- Transfer moves financial impact but not accountability.
- Acceptance must be documented and approved by someone with authority.
- A BIA identifies critical functions, dependencies and recovery priorities.
- Risk appetite is how much risk the organization will take.
- Residual risk is what remains after treatment.
- SLE = AV x EF, and ALE = SLE x ARO.
- Regulatory and legal requirements can force a treatment regardless of appetite.
In a formula question, find the SLE first, then multiply by the ARO to get the ALE. Convert "once every N years" to an ARO of 1 divided by N.
Common mistakes
Thinking transfer removes the duty. The organization still owns the consequences with customers and regulators.
Confusing SLE and ALE. SLE is the loss from one event. ALE is the loss expected over a year.
Entering the exposure factor as a whole number. Use 25 percent as 0.25 when you multiply.
Assuming controls remove all risk. Some residual risk almost always remains.
Treating avoidance as the default. Avoiding the activity also means losing its business benefit.
A BIA that ignores dependencies gives false recovery priorities. Include every system, supplier and person the function relies on.
Check yourself
Which risk treatment is buying cyber insurance?
Transferring, because it moves the financial impact to the insurer.
How is the annualized loss expectancy calculated?
ALE equals the single loss expectancy multiplied by the annualized rate of occurrence.
What is residual risk?
The risk that remains after treatment has been applied.
Topic 3 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.